- Bank of America hired 1,000 contractors and spent hundreds of millions fixing AI-discovered vulnerabilities
- Anthropic’s Mythos uncovered enough flaws to trigger large-scale remediation across major banks
- Financial institutions warn advanced AI security tools are exposing weaknesses faster than teams can patch them
Bank of America, one of the largest financial institutions in the United States, was forced to hire a thousand people on contractor roles, and spend north of a $100 million dollars to fix all of the bugs found by the famed Mythos, Anthropic’s generative artificial intelligence (GenAI) model.
When Anthropic first unveiled Mythos in April 2026, it described it as a tool with advanced cybersecurity capabilities that can autonomously discover and exploit previously unknown software vulnerabilities.
However, the tool was so capable (and dangerous) that Anthropic locked it down, giving access to a handful of vetted organizations: the US government, critical infrastructure organizations, banks, and some cybersecurity firms, to name a few.
Bank of America and JPMorgan Chase
Bank of America was apparently one of those companies, as speaking to CNBC, the bank’s CEO, Brian Moynihan, said that when Mythos started finding bugs in the system, the company saw it as “real risk”, and was forced to sit down and come up with a plan to address all of the vulnerabilities.
“We put on 1,000 contractors to help us do the patching work in the second quarter, and those people remain here today, helping us, on top of the 3,000 people we have in that area,” he told the publication. CNBC added that Moynihan told analysts earlier that day that the company spent “a couple hundred million plus” on fixing bugs and addressing regulatory issues.
Even for a bank of that scale, such hiring and spending sprees are uncommon, to put it mildly. That’s likely why Moynihan added that the spending increase was temporary and that, once the vulnerabilities are addressed, there won’t be as much work as there is now. “Once you patch, you don’t have to patch as much. … The pipeline moves through,” Moynihan said.
In its report, The Next Web put it in the context of staying compliant with state and federal regulations. “The compliance spending follows Treasury penalties of more than $1.21 billion announced on 13 October,” the publication wrote. “Federal regulators said the bank had failed to report suspicious transactions worth $5 billion and to finish steps ordered in 2024.”
Severe fallout
Bank of America is hardly the only bank rushing to fix what Mythos exposed. A few months ago, the CEO of JPMorgan Chase, Jamie Dimon, said the bank was working with peers and vendors to make sure its systems are prepared for what’s coming. “It’s serious work,” Dimon said in a Bloomberg TV interview. “We have, I think, hundreds of people doing it full time now.”
Goldman Sachs’ chief executive, David Solomon, said in mid-April he was “hyper-aware” of the capabilities of Mythos, and added the company was working “closely” with the tech firm. “Obviously the LLMs are making rapid progress and we’re hyper-aware of the enhanced capabilities of these new models with the help of the US government and the model publishers,” Solomon told analysts at the time.
When Anthropic first disclosed Mythos, it said the AI models reached a level of coding capability “where they can surpass all but the most skilled humans at finding and exploiting software vulnerabilities.”
“The fallout – for economies, public safety, and national security – could be severe.”
Many companies that tried it seem to agree. Mozilla, for example, called it “every bit as capable as the world’s best security researchers”, after finding 22 security-sensitive bugs in just one round of testing.
Palo Alto Networks, on the other hand, used Mythos to find more than two dozen critical vulnerabilities in about three weeks, but the tests also showed the companies needed significantly bigger AI security budgets.