In another story that puts a spotlight on the scope of previously undiscovered cyber issues that are being dredged up by AI, Bank of America has announced it will be devoting 3,000 of its internal staff members and drafting an additional 1,000 contractors to address software vulnerabilities uncovered by Mythos AI testing.
Bank of America is the second-largest bank in the US in terms of assets and the third-largest in branch count, with locations in 38 states. While the bank is anticipating hundreds of millions of dollars in added short-term costs from this cleanup effort, it projects a savings of about $700 million in 2027 from remediating what are thought to be thousands to tens of thousands of the software vulnerabilities dredged up by Mythos AI testing.
Bank of America adds over $200 million to cybersecurity budget
The news came from the bank’s recently-released third quarter earnings report, and did not include specific figures on what the project would cost or exactly how many software vulnerabilities were queued up to address. However, CEO Brian Moynihan later told analysts that the company was planning to spend somewhere over $200 million in addition to its established cybersecurity and compliance budget (which is thought to be at least $1 billion annually).
The remediation effort stems from early access to Mythos AI, granted to select critical infrastructure companies months ahead of general public access to provide preparation time for scenarios exactly like this. Bank of America has also not publicly disclosed how many software vulnerabilities it has found since it started probing with Mythos AI, but prior reporting plus inference drawn from the amount of labor being thrown at the project indicates there are likely thousands at minimum and possibly into the low tens of thousands. Prior reporting from other enterprise-scale companies such as Microsoft have indicated that thousands of “low priority” vulnerabilities found by Mythos AI and other frontier models, which can nevertheless be chained into more serious attack vectors by highly capable AI, have been triaged indefinitely as manpower does not exist to address them in the near term.
Despite the vagueness of the numbers, this is nevertheless some of the most firm information yet about what companies are spending and dealing with in terms of AI-uncovered software vulnerabilities. Many companies are now scrambling to play catch-up before cyber criminals start making effective use of frontier AI models as assistants, something that may already be taking place out of China given September advisories issued separately by the NSA/FBI/CIA and Google.
Full-capability Mythos AI remains in limited access as organizations scramble
While a version of Mythos AI was released several months ago under the “Fable” moniker, the full-capability version with limited guardrails remains in its formal “Project Glasswing” testing state with access only granted to about 200 total organizations across 15 countries to this point.
A one-day 8.7% drop in Bank of America’s stock price that followed the news was more about a massive government fine for improper monitoring of transactions and missing both revenue and earnings expectations, but Moynihan addressed the increased spend on software vulnerabilities as part of his attempts to appease investors. He said that the increase in the budget was expected to be a one-time expense that snowballs into improved security on an ongoing basis.
John Strand, Owner of Black Hills Information Security, takes the optimistic view that this is a new job creator in an age in which AI was supposed to gradually put everyone out of work: “What do you call a thousand outside contractors helping Bank of America remediate software vulnerabilities? A good start. That’s an infosec joke, but it also shows one way AI may actually contribute to job growth in computer security. Finding more vulnerabilities creates more work for the people who have to fix them.”
Other banks have hinted at similarly intense efforts to catch up with AI-discovered vulnerabilities, but none yet on the scale of Bank of America’s disclosure. Jamie Dimon, CEO of JPMorgan Chase, has previously indicated in interviews that his bank is doing similar work with at least hundreds of people involved. Goldman Sachs chief executive David Solomon has also indicated that his bank is a Project Glasswing partner and has been addressing an unknown amount of Mythos AI-discovered vulnerabilities.
But this increased spending on security has also come amidst job cuts. Bank of America recently terminated some 3,000 jobs, though it is not exactly clear what the positions were. In 2025 the bank also came under scrutiny for its workplace policies after a 35 year old employee that had been working 100-hour weeks died of a heart attack. A Wall Street Journal investigation found that managers were ordering employees to work all-nighters and in some cases lie to Human Resources department members about hours worked.
Jacob Krell, Senior Director, Secure AI Solutions & Cybersecurity for Suzu Labs, points out potential issues with rapidly onboarding such a large number of outside contractors: “Bank of America’s 1,000 remediation contractors confirm what I have argued for a while now, the chokepoint has moved from finding vulnerabilities to fixing them. AI models like Anthropic’s Mythos can surface weaknesses faster than any bank can patch, so remediation capacity becomes the scarce resource, and Moynihan’s $200 million in added quarterly expenses puts a price tag on how scarce.”
“Hiring that capacity this way creates its own exposure,” Krell adds. “A bank’s vulnerability inventory is effectively a targeting package, it maps exactly where the defenses are weak across internal software and third-party vendor code. Handing it to 1,000 outside contractors, roughly one contractor for every three existing security employees, distributes the bank’s most sensitive operational intelligence to people sitting outside its HR controls, monitoring, and enforcement chain. The bank can say the contractors follow the same security practices as employees, but without employee-grade endpoint logging and access oversight, the claim is unverifiable.”
Numerous other companies have reported using Mythos AI to uncover large amounts of software vulnerabilities in a short amount of time. Mozilla used it to locate some 271 previously undiscovered issues in Firefox 150, Palo Alto Networks reported its monthly “find rate” for vulnerabilities increasing 7x when it began using Mythos AI, and Cloudflare is also now regularly using it to test its own infrastructure. AWS and Microsoft have also both reported integrating it into their regular security operations.
