Finding bugs is cheap. Bank of America's 1,000 contractors show who pays

What if the most expensive part of an AI cybersecurity breakthrough isn't the AI? Bank of America's answer, delivered in the least glamorous way possible, is 1,000 extra people with laptops.

A bank's Mythos bill is paid in people, not licenses

CEO Brian Moynihan told CNBC that the bank hired 1,000 contractors to patch software flaws exposed by Anthropic's Mythos. According to Finextra, they work alongside 3,000 internal staff. TechRadar's headline summary says the effort ran to hundreds of millions, though we'd treat that figure cautiously until the bank itemizes it.

This is a rare look at what the Mythos era costs a real institution, and it is not a model license fee.

Discovery got cheap; repair did not

Anthropic says Mythos found thousands of previously unknown vulnerabilities, and, per ArmorCode's summary, it produced working exploits on the first try in over 83% of cases. Impressive. But a bug report is not a fix. Someone has to understand the code, change it, test it, schedule it, and avoid breaking a payments system on a Tuesday.

That is the part nobody can scale with a press release. Our view: the bottleneck moved from discovery to remediation labor, and the Bank of America headcount is the first hard price tag on that shift. The security industry has long had more findings than fixes. Mythos didn't create that backlog; as Mitiga puts it, it exposed how unsustainable the backlog already was. We think that's right.

There's also a quieter point. As CNBC reported, researchers say much of what Mythos found can be reproduced with existing public models orchestrated cleverly. If so, the supply of findings isn't tied to one gated model. It's going to keep coming, from many tools, to every company with code.

Banks feel it first because they can't skip the queue

Banks run old core systems, third-party integrations and heavy change control, which is exactly where fixes are slowest. One banking commentator argued that core providers often represent a bank's largest attack surface. That's an opinion, but it matches the shape of the problem: you can't patch a vendor's code by hiring a contractor.

Regulators also won't grade intent. The same commentary notes that after an incident, scrutiny falls on whether the institution had control at the speed the threat demanded. So a bank with a backlog has a governance problem, not just an IT one. Throwing 1,000 people at it is the rational response of an institution that can't afford to be the slow one.

Notice who wins. Not defenders, at least not yet. We'd bet the winners so far are the firms selling remediation: contractors, automation vendors, and compensating-control tools. Vendors like Moderne pitch exactly this, claiming that fixing one vulnerability across 2,000 repositories shouldn't cost 2,000 times as much. That's marketing, and unproven here, but it points at where the money may be heading.

Headcount is a stopgap, not a strategy

Hiring contractors scales linearly; the findings may not. If, as Anthropic's team reportedly estimates, comparable capabilities spread to other labs within six to eighteen months, many large companies will soon point such tools at their own proprietary code. Backlogs, ArmorCode argues, could grow by orders of magnitude. Nobody hires their way out of that.

So what should the reader, or the CISO, do? Three things, in our opinion. Prioritize ruthlessly by actual exposure, not raw severity. Pre-authorize mitigations such as isolation so they don't wait for the next change window. And budget for fixing, not finding: if your AI-scanning line item is bigger than your remediation line item, you've probably misread the problem.

The verdict

For ordinary customers asking whether their money is safe: none of the reporting we've seen says Bank of America was hacked. This is a story about a bank spending heavily to get ahead of flaws, which is better than ignoring them. The lesson isn't that AI broke banking. It's that the bill for AI-speed discovery lands on human-speed repair, and 1,000 contractors is simply the first invoice we've seen.