Bank of America added 1,000 contractors to patch flaws found by Claude Mythos, Moynihan says, and expects $700 million in AI benefits in 2027

Bank of America brought in 1,000 contractors to fix software flaws found with Anthropic's Claude Mythos models, CEO Brian Moynihan said on October 14, 2026. He made the comments on the bank's third-quarter earnings call and in an interview with CNBC. It puts a concrete number on what it takes a large company to act on AI-found vulnerabilities. On the same call, Moynihan said the bank's AI projects should deliver $700 million in benefits next year.

This story is based on two published transcripts of Bank of America's October 14 earnings call, CNBC's interview as quoted by ITPro and excerpted on Slashdot, reporting by The Register, and Banking Dive's report on regulators' October 13 penalty announcements, checked October 16, 2026.

The short version

• Contractors: 1,000 consultants added in the second quarter to patch Mythos findings, on top of about 3,000 people already doing that work, Moynihan said.
• Cost: "a couple hundred million plus" in third-quarter remediation, covering both Mythos fixes and anti-money-laundering work. No split was given.
• AI benefits: $250–300 million in 2026, rising to $700 million in 2027, from about 130 AI projects, by Moynihan's estimate.
• Not disclosed: how many vulnerabilities Mythos found, how severe they were, or how much of the bill was for Mythos fixes.

What did Moynihan say about Mythos?

Analyst Mike Mayo asked about expenses and AI productivity. Moynihan said a "couple hundred million plus in the third quarter were two things, remediation for the AML and remediation for the Mythos implementation." He said "we added 1,000 extra staff to work on that, not in the headcount but in consultants," and that "we expect that the Mythos remediation costs run down."

He gave more detail in an interview with CNBC the same day. "We put on 1,000 contractors to help us do the patching work in the second quarter," he said, according to ITPro, which quoted the interview. Those contractors are still working "on top of the 3,000 people we have in that area." "That risk is real risk," he said, adding that "a lot of us sat down" to work out how to respond quickly. "Once you patch, you don't have to patch as much," he added.

According to CNBC's account, as excerpted on Slashdot, the bank rushed earlier in 2026 to shore up both its internal code and code from its vendors.

What is Claude Mythos, and how did the bank get it?

Mythos is Anthropic's most capable model family for security work, and it isn't sold to the general public. Anthropic first gave access through Project Glasswing, a program for selected organizations. On October 6, 2026, it folded Glasswing into a three-tier Cyber Verification Program that now includes Claude Mythos 5.1 (our Cyber Mission story). Reuters reported on May 12, 2026, that Bank of America was among the large banks with access to Mythos.

Anthropic says Glasswing partners found "at least 129,000 verified software vulnerabilities between April and July 2026," based on partial data. That number is Anthropic's own and hasn't been independently audited. Our Claude Opus 5.5 system card explainer covers how Anthropic compares Opus 5.5's cyber abilities with Mythos 5.1. Our report on Anthropic's evaluation incidents shows what Mythos models have done when they had more access than intended.

How much is the bank spending, and why is the number muddy?

Moynihan's "couple hundred million plus" combines two things. One is the Mythos patching. The other is anti-money-laundering remediation. On October 13, the day before earnings, the US Treasury announced penalties of more than $1.21 billion against Bank of America, Banking Dive reported. That includes a $1.2 billion FinCEN penalty (which credits a record $750 million OCC fine) and an $11.6 million OFAC settlement over sanctions violations. Regulators said the bank failed to file suspicious activity reports on $5 billion in transactions.

Because the two efforts are combined, the Mythos share of the bill isn't public. Treat any single dollar figure for "Mythos costs" with caution unless the bank breaks it out.

What AI benefits does Bank of America expect?

Moynihan said the bank has "about 130 different projects implemented," each with a payback. "Overall, the benefits are 2x-3x over time of the expense you are giving out," he said. "We expect that number to go from the $250, $300 this year to $700 million next year." He also said the technology organization is "10% more efficient, so next year we get 10% more work for the same cost."

These are management estimates, not audited results. Moynihan didn't explain how the bank measures "benefits," whether they're cost savings, added revenue or both, or how much of the gain comes from fewer people. Total expenses rose about $1.2 billion from a year earlier while headcount fell by about 3,000, he said; CFO Alastair Borthwick put the headcount decline at nearly 3,500. Moynihan attributed about $450 million of the expense rise to wealth-management incentives and about $300 million to the markets business.

Why it matters

AI models are finding software flaws faster than organizations can fix them. Microsoft's October Patch Tuesday fixed more than 1,400 CVEs, a record by BleepingComputer's count, and Anthropic said on October 8 that it found more than 29,000 candidate open-source vulnerabilities in six months but could triage only about 6,000 by hand. Bank of America's answer was to hire people, a lot of them, quickly. The same bottleneck is behind the October 15 AI security acquisitions, as model makers and security firms try to own the step between "found" and "fixed."

For other companies with access to Mythos-class tools, the lesson is to budget for remediation, not just scanning. A scan is cheap compared with the work it creates.

What's confirmed, reported and uncertain

• Confirmed (earnings call transcript, October 14): the 1,000 consultants, "remediation for the Mythos implementation," the combined "couple hundred million plus" cost, the expectation that Mythos costs will fall, the 130 AI projects and the $250–300 million to $700 million benefit estimate.
• Reported (CNBC interview, as quoted by ITPro and excerpted on Slashdot): that the contractors started in the second quarter, the existing 3,000 staff, and the inclusion of vendor code.
• Reported (Banking Dive, Reuters): the October 13 AML penalties; Bank of America's Mythos access (Reuters, May 12).
• Uncertain: how many flaws Mythos found and how severe they were; the Mythos share of remediation costs; how "AI benefits" are defined. The bank hasn't given a count of Mythos findings, on the call or in the CNBC interview as quoted.