Bank of America Hired 1,000 Contractors to Address AI-Discovered Vulnerabilities
Bank of America incurred significant costs and hired 1,000 contractors to remediate vulnerabilities identified by Anthropic's Mythos AI model.
Bank of America has reportedly hired 1,000 additional contractors to address a substantial number of vulnerabilities identified by Anthropic's advanced AI model, Mythos. The bank's chairman and CEO, Brian Moynihan, disclosed during the company's third-quarter earnings call that remediation costs associated with these findings, alongside anti-money laundering (AML) order compliance, exceeded "a couple of hundred million plus." While this initial surge in patching efforts required significant external resources, the bank anticipates that such extensive remediation will not be a long-term issue.
The decision to bring in a large contingent of external help stemmed from growing concerns about the bank's capacity to rapidly tackle the sheer volume of issues flagged by Mythos. Anthropic had marketed Mythos as a groundbreaking tool capable of revolutionizing cybersecurity by identifying complex vulnerabilities with unprecedented speed. While the model proved highly effective, early adopters, including Mozilla's CTO Bobby Holley, noted that Mythos's capabilities, while impressive, did not surpass those of elite human researchers in finding novel or complex flaws.
The 1,000 contractors augmented Bank of America's existing technical staff of approximately 3,000 individuals. Although their assistance was crucial for the immediate patching effort, their engagement is expected to be temporary. Moynihan indicated that the bank is leveraging AI across around 130 projects, aiming for significant returns on investment. He projected that AI initiatives would deliver between $250 million and $300 million in benefits in 2026, with expectations of this figure rising to $700 million by the end of 2027.
While the bank has also undergone workforce reductions, including a decrease in management roles, the exact impact of AI on these changes was not specified. Moynihan did not provide a detailed breakdown of the remediation costs, lumping together expenses related to AI findings and AML issues. The bank's financial performance was impacted by a $1.21 billion settlement with the Treasury's Financial Crimes Enforcement Network (FinCEN) for failures in policing national security risks and reporting suspicious activity, as well as a $750 million penalty from the Office of the Comptroller of the Currency for compliance deficiencies.
This large-scale remediation effort highlights the dual nature of AI in cybersecurity: its potential to uncover complex threats more efficiently, but also the significant operational and financial implications when such discoveries necessitate widespread system updates. The bank's experience underscores the need for robust internal processes to manage and integrate AI-driven security insights, even as it embraces the technology for broader efficiency gains.
The incident also brings into focus the evolving landscape of AI in enterprise security. While tools like Mythos promise to enhance threat detection, their findings can trigger substantial remediation projects, requiring careful planning and resource allocation. Bank of America's proactive, albeit costly, response demonstrates a commitment to addressing identified risks, even when they emerge from novel AI-powered discovery methods.