Bank of America hired 1,000 outside contractors to help patch software vulnerabilities exposed by advanced AI models, including Anthropic’s Mythos, CEO Brian Moynihan told CNBC. The contractors supplemented roughly 3,000 internal staff working in the area, according to CNBC’s October 14 report.
The outside workforce amounted to about one-third of the bank’s existing internal staffing in that area. It puts a staffing figure behind the additional work that more capable security models can create for organizations responsible for fixing the vulnerabilities they find.
Moynihan described a response to advanced AI models, with Mythos among them. His comments do not establish that Anthropic found every vulnerability or provide a count of flaws discovered at the bank.
The Contractors Arrived in the Second Quarter
By the time Moynihan discussed the hiring in an interview following Bank of America’s third-quarter earnings release on October 14, 2026, the contractors had been working at the bank for months.
“We put on 1,000 contractors to help us do the patching work in the second quarter, and those people remain here today, helping us, on top of the 3,000 people we have in that area,” Moynihan said.
The work covered both the bank’s internal software and vendor code, CNBC reported. Remediation therefore extended to software Bank of America could not necessarily change on its own.
Together, the figures describe roughly 4,000 people across existing staff and outside contractors, not 4,000 new hires. Moynihan’s wording also does not establish that every internal employee worked exclusively on vulnerabilities discovered by AI.
Bank of America added capacity during the second quarter and still had those contractors in place when it reported third-quarter results. This was an ongoing staffing response, not a hiring plan awaiting implementation.
For security leaders, the duration is as relevant as the headline number. The bank needed sustained staffing beyond a brief assessment and immediate return to normal operations. The disclosure does not specify contractor hours, individual assignments or a completion date.
The Expense Figure Is Not a Standalone Mythos Bill
Moynihan also told analysts that software remediation and regulatory issues related to anti-money laundering compliance together cost the bank a “couple hundred million plus” during the third quarter.
That combined expense should not be presented as the cost of patching Mythos-discovered vulnerabilities alone. The reporting neither separates contractor fees from internal labor and other remediation expenses nor isolates software-security spending from anti-money laundering work. Dividing the figure by 1,000 contractors would produce a misleading estimate of contractor cost.
