Bank of America hires 1,000 contractors to patch AI-exposed software flaws

CHARLOTTE, US: Bank of America has engaged 1,000 external contractors to repair software vulnerabilities identified by Anthropic’s advanced artificial intelligence model, Mythos. The move, disclosed by Chief Executive Brian Moynihan on Wednesday, underscores the substantial financial and operational resources required to defend legacy systems against AI-driven security threats.

The AI model, released in April to a select group of financial institutions, technology firms, and government agencies, rapidly exposed decades-old flaws in proprietary and vendor-supplied code. In response, the lender mobilised thousands of personnel to address the security gaps, accelerating remediation timelines from weeks to mere days by May. The contractors were brought on board in the second quarter and continue to work alongside 3,000 internal employees dedicated to the patching effort. 'That risk is real risk,' Moynihan stated regarding the urgency of the operation.

During the third-quarter earnings call, Moynihan revealed that the bank spent upwards of $200 million (approximately Rs 1,600 crore) on software remediation and anti-money laundering compliance combined, as reported by CNBC. This expenditure follows a $1.2 billion (approx Rs 9,600 crore) penalty imposed by the US Treasury Department’s Financial Crimes Enforcement Network for failures in reporting suspicious transactions. Despite the immediate financial hit, which caused the bank's shares to drop by as much as 8 per cent on Wednesday as reported by Quartz, Moynihan assured investors that the surge in defensive spending is temporary. 'Once you patch, you don’t have to patch as much,' he stated, expecting the remediation costs to decline as the pipeline of fixes moves through.

The situation illustrates the dual-edged nature of artificial intelligence in the financial sector. While AI models like Mythos can uncover critical vulnerabilities, they also force institutions into a costly defensive scramble. Cybersecurity analysts note that most enterprise security teams lack the capacity to suddenly expand their workforce by a third to handle the influx of AI-discovered flaws. Industry guidance from the Financial Services Information Sharing and Analysis Center and JPMorgan Chase advises banks to prioritise fixes based on actual exploitability and internet exposure rather than relying solely on traditional severity scores. This shift in strategy is critical, as organisations face approximately 40,000 new vulnerabilities annually, a volume expected to multiply with AI-accelerated discovery.

Looking ahead, the bank is leveraging AI to offset these defensive costs. Bank of America currently runs approximately 130 internal AI projects, which are projected to generate $700 million (approx Rs 5,600 crore) in savings next year, up from $300 million this year. Meanwhile, the institution has reduced its overall headcount by roughly 3,400 employees over the past year, primarily through cuts to middle management, though the exact proportion attributable to AI remains unclear.