America's second-largest bank, Bank of America (BoFA), may have just told everyone how dangerous AI agents can be for companies. According to Bank of America CEO Brian Moynihan, the bank has enlisted an army of external contractors and deployed thousands of tech workers to fortify its code against emerging cybersecurity threats posed by frontier artificial intelligence.
CEO Brian Moynihan revealed the same in an interview with CNBC.The defensive overhaul was reportedly triggered after advanced AI Agents, including Anthropic’s Mythos -- demonstrated a heightened capacity to pinpoint and exploit longstanding software vulnerabilities across bank's internal and vendor networks. “That risk is real risk, and that’s why when the frontier-type models came out... a lot of us sat down and said, ‘How do we figure out how to get through this quickly?’” Moynihan told CNBC’s Leslie Picker following the release of the bank’s third-quarter earnings.To deal with an immediate threat, the bank hired 1,000 third-party contractors during the second quarter. Those specialists joined 3,000 existing internal staff dedicated to software maintenance and security, Moynihan said, and they remain actively engaged in remediation efforts.The emergency response meant a substantial cost for the bank. Moynihan told analysts that the bank incurred a "couple hundred million plus" in expenses during the third quarter alone, tied to the software patching campaign alongside anti-money laundering regulatory compliance measures.
Moynihan’s remarks offer an unusually transparent glimpse into the tangible dollar and labor costs that major US financial institutions face as they confront the unintended fallout of rapid AI innovation. Mythos was distributed in April to a select cohort of banks, technology firms, and government agencies, setting off an urgent defensive scramble across corporate America to remediate decades-old coding gaps before malicious actors could take advantage of similar frontier tooling.“We’ve got to stay ahead of them, and we’ve got to be mindful that the people doing the software development are the people trying to sell us the services,” Moynihan said.The spending disclosures comes against a challenging market backdrop, with Bank of America shares sliding as much as 8%. Addressing investor concerns over escalating overhead, Moynihan emphasized that the surge in cybersecurity contracting would be temporary.
“Once you patch, you don’t have to patch as much... the pipeline moves through,” Moynihan said, noting that remediation expenses are projected to taper off once core vulnerabilities are sealed.
'Bank of America is replacing only 75% of employees who leave'
Even as the bank absorbs short-term defensive costs, it is actively leaning on AI to drive broader operating efficiencies. Bank of America currently operates roughly 130 internal AI initiatives. The bank expects annual cost savings generated by those systems to jump from $300 million this year to $700 million by 2027.Over the past year, the lender reduced its overall workforce by roughly 3,400 positions, a drawdown that included shedding about 5% of its management ranks. Speaking at an event, Brian said that BofA has an employee attrition rate ranging from 8% to 8.5%. Based on current headcount, the implication is that around 1,400 people leave each month, at least. When they do, he said that the Bank only replaces 1,000 of them. The other 300 jobs must be 'owned' he said.
More prosaically, they must be done by existing staff.Fortunately, AI is around to help with this. "In the end of day, our teammates have got to use AI to make our company better and make our clients a better experience," declared Moynihan. BofA now has "150 use cases implemented" and is deploying AI into "more work," he said too. This work includes audit, legal and other areas. And BofA's 18,000 coders have "saved" 10-15%, which is being redeployed.
Bank of America fined $1.2 billion
The US government has imposed a $1.2 billion fine on America’s second-biggest bank. The amount is the third-largest in the department’s history. “When a bank of this size fails to meet its anti-money laundering and sanctions obligations, the consequences extend far beyond its own walls, exposing the entire U.S. financial system to significant illicit finance risks,” Treasury Secretary Scott Bessent said in a statement.
“Today’s actions send a clear message that even the biggest financial institutions are not above the law.”In a statement, Treasury said that its Financial Crimes Enforcement Network (FinCEN) assessed the $1.2 billion penalty for Bank of America’s “failure to mitigate and report priority national security risks, including Chinese Money Laundering Networks and illicit finance along the southwest border."“Financial crime compliance is serious, and we are responsible for getting it right,’’ Bank of America said in a statement. It added, “We have invested billions of dollars in technology and dedicated thousands of employees to combat financial crime, and our team is far along with and committed to completing the work required to address the issues raised by our regulators."