Bank of America hired 1,000 outside contractors in the second quarter to help repair software vulnerabilities identified by advanced artificial-intelligence models, including Anthropic’s Mythos, Chief Executive Brian Moynihan said. The contractors are working alongside about 3,000 internal technical employees as the bank accelerates remediation across software used by the bank and its vendors, according to CNBC’s report.
Moynihan said Bank of America spent “a couple hundred million plus” during the third quarter on software remediation and regulatory work tied to its anti-money-laundering program. He did not separate the amount spent on vulnerabilities surfaced by Mythos from the costs associated with compliance failures, so the disclosure does not establish a standalone price for the AI-led security work.
The bank has not disclosed how many of the identified flaws were critical, whether any were exploitable over a network, or whether attackers exploited any of them. No CVE identifiers, CVSS scores, public proof-of-concept exploits, or exploitation-in-the-wild reports were identified in the disclosures reviewed for this report. That makes the contractor count a measure of remediation workload, not evidence that the vulnerabilities were exploited or uniformly severe.
The security effort coincides with a separate regulatory crisis. The U.S. Treasury said the Financial Crimes Enforcement Network assessed a $1.2 billion penalty after finding that Bank of America failed to maintain an effective anti-money-laundering program, perform required due diligence for correspondent accounts, and file suspicious-activity reports. The agency said the bank failed to report more than $5 billion in suspicious transactions, including activity involving Chinese money-laundering networks and other national-security risks. Treasury’s enforcement announcement requires a third-party lookback and independent reviews of the bank’s transaction monitoring, customer due diligence, correspondent-account controls, and relevant data governance. [1]
The Office of the Comptroller of the Currency separately assessed a $750 million civil penalty for deficiencies in Bank of America’s Bank Secrecy Act and anti-money-laundering controls, while the Office of Foreign Assets Control announced an $11.6 million settlement covering 475 apparent sanctions violations involving programs including Iran, Russia, narcotics, and global terrorism. The OCC said the penalty was imposed for a deficient and ineffective compliance program. [4]
For defenders, the disclosures underscore the operational cost of using AI to expand vulnerability discovery: finding weaknesses can create a remediation queue that is larger than existing engineering capacity. Bank of America said its contractor support is expected to decline as the initial patching workload is completed, but it has not published a vulnerability inventory or remediation timetable. Organizations using similar systems should prioritize findings through asset ownership, exploitability, exposure, and business impact, then validate fixes with independent testing rather than assuming that an AI-generated finding is either harmless or immediately exploitable.
References
- U.S. Treasury Announces Record Enforcement Actions Against …
- OCC Imposes $750 Million Assessment Against Bank of …
