Bank of America Hired 1,000 Contractors to Patch AI-Found Bugs
Bank of America reportedly brought in 1,000 contractors and spent large sums fixing software flaws identified by Anthropic's Mythos AI model.
According to TechRadar, Bank of America had to hire about 1,000 contractors to fix software flaws that were identified by Mythos, a generative AI model from Anthropic. The outlet reports that the bank spent more than $100 million on the remediation work, which it describes as covering all of the bugs the model found.
The Register reports that the bank's chief executive said the contractors were brought in during the second quarter of the year and are still helping with the work today. That account indicates the effort has been ongoing for some time rather than being a one-off fix.
TechRadar notes that Anthropic first unveiled Mythos in April 2026 and described it as a tool with advanced capabilities. The source material does not detail the exact methods Mythos used to find the flaws, nor which specific systems were affected.
TechRadar also reports that the episode points to a wider concern across major banks. Financial institutions, according to the outlet, worry that advanced AI security tools are surfacing weaknesses faster than organizations can repair them. The reporting suggests the issue extends beyond a single firm.
Neither outlet's summary provides independent confirmation of the cost or headcount figures, so readers should treat them as the outlets' reported numbers.
Background
Software vulnerabilities are flaws in code that attackers can exploit to gain access to systems, steal data or disrupt services. Finding them is only the first step. Each one must be verified, prioritized by risk, assigned to the right team, fixed and then tested to make sure the fix does not break something else. In large organizations, especially those running older systems built up over decades, this work can take months or years.
Automated scanning tools have long been used to find weaknesses. Static analysis checks source code for risky patterns, while dynamic testing probes running applications for behavior that could be abused. More recently, machine learning and large language models have been applied to code review, which can speed up discovery and sometimes surface issues that conventional tools miss.
Banks face particular pressure. They run complex networks that mix modern cloud services with legacy mainframe systems, and they are subject to regulatory expectations for operational resilience and cybersecurity. Supervisors in many countries expect firms to track known weaknesses and remediate them within defined timeframes, so a sudden increase in discovered issues can create a significant workload.
A general pattern in security is that discovery and remediation do not scale at the same rate. A tool that can flag many potential problems in minutes may still leave human teams with a backlog that takes far longer to clear. Security researchers have long discussed this gap between finding and fixing as a structural challenge in software maintenance.
Why it matters
The reported story illustrates a practical consequence of AI-assisted security work. When a tool becomes better at finding flaws, the immediate effect may be a larger queue of problems rather than a safer system. An organization has to decide how to triage that queue, how much to spend on it and how to prevent new issues from piling up behind it.
For customers of large banks, the question is whether the backlog translates into real exposure. The outlets do not report any breach or customer harm in the material provided, so the story is best read as one about the cost and effort of defense. Still, the time between identifying a weakness and closing it is the window in which attackers could act, which makes the pace of remediation important.
The story also raises questions for the broader industry. If a major bank needed a large temporary workforce, smaller firms with fewer resources may struggle more. That could widen the gap in security quality across the financial sector, with well-funded institutions better able to keep up.
Finally, the report touches on how AI companies describe their tools. Claims about advanced capability are easy to make at launch, but the downstream costs of acting on AI findings are less visible. Those costs are part of the real-world picture of how these systems are used.
What to watch
Watch whether other banks or large enterprises publicly describe similar remediation efforts tied to AI-driven scanning. Confirmation from additional sources would help clarify how common this situation is.
Look for any official statements from Bank of America or Anthropic that address the figures, the scope of the flaws and the timeline. Details on severity and whether any of the flaws were actively exploited would change how the story is understood.
Regulators may respond if the backlog affects security posture. Any guidance on AI-assisted vulnerability discovery, or on how firms should report and prioritize findings, would be significant for the sector.
Finally, pay attention to whether vendors begin offering tools or services aimed at remediation rather than only discovery, since the reported gap between finding and fixing may shape the next wave of products.
Viewpoints
Commentary from our columns: three angles on this story.
The Skeptic open questions and weak points
The headline numbers are striking: a thousand contractors and more than $100 million. Before accepting them as a measure of AI's value, it is worth asking what they actually show. A large remediation effort could reflect a tool that finds genuinely serious problems, or it could reflect a backlog of minor issues that any thorough audit would surface. The reporting does not separate those possibilities. How many of the flaws were severe, how many were already known, and how many were fixed without any real exposure are all open questions. Without that breakdown, the cost tells us about effort but not necessarily about risk reduction. It is also fair to ask whether the comparison is between AI-assisted and traditional review, or whether there is no baseline at all. Good reporting would press for those answers before concluding that the technology is either a breakthrough or a burden.
The Builder the engineer's view
From an engineering standpoint, the interesting part of this story is the gap between discovery and remediation. Finding a flaw is often the easy step; verifying it, understanding its blast radius, writing a fix and testing that fix against complex legacy systems is where the time goes. Banks run layered architectures that mix modern services with systems that were built long ago, and a patch in one place can break dependencies somewhere else. Hiring a large contractor pool suggests the bottleneck was human capacity to review and change code, not the scanning itself. That points to an architectural lesson: tooling that generates findings should be paired with pipelines that route, test and deploy fixes. Teams that invest in automated regression testing and clear ownership of components will likely handle a surge of findings far better than those relying on manual triage alone.
The Rulebook privacy, safety and regulation
When a major financial institution spends heavily to repair software flaws, the regulatory questions are immediate. Banks are expected to manage cybersecurity risk and to remediate known weaknesses within reasonable timeframes, and a large backlog raises the question of how long those weaknesses remained open. The reporting does not say whether customer data was affected, and it should not be assumed. Still, regulators and customers have a legitimate interest in knowing how findings are tracked, prioritized and closed. As AI tools make it easier to identify vulnerabilities, policy frameworks may need to address disclosure, documentation and accountability for how those findings are handled. The core principle is simple: discovering a problem creates a duty to act on it, and oversight should make sure that duty is met transparently and promptly.