# Bank of America Hired 1,000 Contractors to Fix Bugs an AI Agent Found > Source: > Published: 2026-10-15 19:00:03+00:00 *An AI model built to hunt software vulnerabilities found so many at Bank of America that fixing them became its own staffing problem, not a quick patch job.* Bank of America brought on 1,000 contractors this year just to triage and fix the volume of software flaws that Anthropic's Claude Mythos uncovered inside the bank's systems, CEO Brian Moynihan told CNBC. Those contractors now work alongside the bank's existing 3,000-person security team, a scale of remediation work that didn't exist before the bank started pointing an AI agent at its own code. Moynihan has been blunt about what changed. "It is a big change in the amount of work that will have to go on and the pace at which these tools will affect vulnerabilities in your systems, and how fast you have to take care of that," he said in a Bloomberg Television interview earlier this year. Bank of America isn't an outside target here. It's one of the Wall Street institutions Anthropic authorized to run Mythos against its own infrastructure, and the bank has reportedly shared what it found with peer institutions. Anthropic released Mythos in April under a program it calls Project Glasswing, initially restricting access to a small group of banks, tech firms and government bodies. The model is built specifically for offensive cybersecurity work: finding and, in demonstrations, actually exploiting vulnerabilities in existing code, without the operator needing deep security expertise themselves. That's a different proposition than a chatbot flagging a typo in a config file. What it found wasn't trivial. During testing, Mythos surfaced thousands of zero-day vulnerabilities across major operating systems and browsers, including a flaw in OpenBSD that had sat undetected for 27 years and a bug in the video library FFmpeg that had survived five million passes of automated testing without being caught. Most of the flaws found across the banking sector were rated low to moderate severity, but the sheer volume is the story. The-decoder reported that Bank of America has put roughly 4,000 people in total on remediation tied to Mythos and other AI models, a figure that folds the new contractors in with existing staff. [The ECB wants banks to treat AI cyber risk as urgent.](https://startupfortune.com/the-ecb-wants-banks-to-treat-ai-cyber-risk-as-urgent/) The ECB is pushing euro area banks to prepare for AI-assisted cyberattacks after warnings around Anthropic's Claude Mythos Preview. The message is clear: AI adoption now brings a sharper compliance and operational resilience test for lenders. - [how ECB banks treat AI cyber risk urgently](https://startupfortune.com/the-ecb-wants-banks-to-treat-ai-cyber-risk-as-urgent/) - [AI cybersecurity vulnerabilities as live business risks](https://startupfortune.com/the-ecb-wants-banks-to-treat-ai-cyber-risk-as-urgent/) The discovery rate alarmed people well outside the bank's own security org. US Treasury Secretary Scott Bessent and Federal Reserve Chair Jerome Powell convened chief executives from systemically important banks, including Goldman Sachs, Citigroup, Morgan Stanley and Wells Fargo alongside Bank of America, to discuss what it means when one model can expose this much latent risk in financial infrastructure at once. Anthropic has since limited broader distribution of Mythos after a partial code leak and a reported case of unauthorized access through a third-party vendor, according to multiple reports following the story. Timelines for fixing what Mythos finds have also compressed. Remediation windows that used to run for weeks reportedly shrank to days once banks saw how fast new findings piled up. That's the part worth sitting with: the AI didn't make the bugs. They were already there, buried in code that passed years of conventional testing. Mythos just made them visible all at once, faster than any human review process was built to absorb. That's the real tension in this story, and it cuts against the simple panic narrative. A model that finds a 27-year-old OpenBSD flaw is doing exactly what defenders have wanted vulnerability research to do for decades: find the bug before someone else weaponizes it. The catch is that finding bugs at machine speed doesn't make fixing them any faster. Code review, patch testing and deployment still run on human schedules, and now someone has to staff that gap. Bank of America's answer was to hire 1,000 people to do it. Anthropic is also now in the awkward position of having built a tool good enough at offensive security that regulators are treating its release schedule as a systemic risk question, not a product question. The company has since started extending Mythos access to banks outside the US, including a planned rollout to UK institutions following talks with the Financial Conduct Authority and the National Cyber Security Centre. Whether that expansion calms the nerves in Washington or widens the group of banks facing their own 1,000-contractor bill is still an open question, and it's the one that will decide how this actually plays out. **Also read:** [Meta released an open AI model so big it needs 1TB of Mac memory](https://startupfortune.com/meta-released-an-open-ai-model-so-big-it-needs-1tb-of-mac-memory/) • [Fed's Goolsbee warns the AI spending boom is now pushing broad inflation](https://startupfortune.com/feds-goolsbee-warns-the-ai-spending-boom-is-now-pushing-broad-inflation/) • [Nvidia Releases Nemotron 3.5 Super VL to Widen the Open-Weight AI Field](https://startupfortune.com/nvidia-releases-nemotron-35-super-vl-to-widen-the-open-weight-ai-field/) *This article is posted in [AI News](https://startupfortune.com/category/ai/), check it out for more related stories.* ## Join the discussion [Open in the community →](https://startupfortune.com/community/) Almost there. Sign in and your reply posts straight away.