CEO Moynihan reveals BoA hired 1,000 contractors to patch AI-found bugs

Bank of America drafted in 1,000 outside contractors during the second quarter to patch the vulnerabilities uncovered by Anthropic's Mythos AI model, CEO Brian Moynihan disclosed on the bank's Q3 earnings call Wednesday. The temporary surge, layered on top of BoA's existing 3,000 technical staff, was needed to handle the sheer volume of flaws the AI identified, and those contractors are still on the job today. Moynihan told financial analysts that the bank brought in outside help after concerns grew over how quickly it could tackle all the work associated with Mythos' discoveries.

The price tag is substantial. Moynihan put remediation costs at "a couple of hundred million plus," combining spending tied to Mythos with the anti-money laundering (AML) orders issued this week. He did not break down how much went to each. The costs are expected to decline over time, he said, as the initial burden of patching a large number of flaws eases. For now, the contractors remain, though their assistance won't be needed in the longer term.

The scale of the cleanup reflects how Anthropic marketed Mythos. The model was positioned as an all-powerful cybersecurity force that threatened the status quo, and early adopters shared concerns globally about how to manage the volume of work it generated. It turned out to be highly effective, identifying complex vulnerabilities faster than humans and triggering a massive influx of patches. But it was not magic. Mozilla CTO Bobby Holley said in April, after Mythos found 271 flaws in Firefox 150: "So far we've found no category or complexity of vulnerability that humans can find that this model can't." He added: "We also haven't seen any bugs that couldn't have been found by an elite human researcher."

For Bank of America, the AI push is not just about security. Moynihan said the bank has made its tech engineering workforce around 10 percent more efficient, and each of its roughly 130 AI-related projects is expected to deliver a 2x or 3x return on investment over time. In 2026 alone, he expects AI projects to generate between $250 million and $300 million in benefits, a figure he projects will rise to $700 million by the end of 2027. He did not detail how those numbers would be achieved.

The efficiency drive has already touched headcount. The bank has reduced around 3,000 roles, including a 5 percent decrease in the number of managers on the payroll, although it did not specify how much of that reduction was driven by AI. The workforce changes come alongside a broader regulatory reckoning. BoA's share price slid more than 8 percent on Wednesday morning after it reported a 17 percent drop in profits, owing to the $1.21 billion settlement it agreed to with the Treasury's Financial Crimes Enforcement Network (FinCEN).

The FinCEN order relates to BoA's failure to police national security risks, including Chinese money laundering, and a failure to report over $5 billion in suspicious activity. The order was issued concurrently with a $750 million penalty from the Office of the Comptroller of the Currency, related to Bank Secrecy Act and AML compliance deficiencies. BoA also agreed to an $11.6 million settlement with the Office of Foreign Assets Control for sanctions violations, including those related to Iran, Russia, narcotics, and global terrorism.

The combination of AI-driven remediation and regulatory fines creates a complex picture for executives. On one hand, AI tools like Mythos can surface problems faster than human teams, forcing organizations to scale up patch capacity quickly. On the other, the upfront costs can run into the hundreds of millions, and the workforce implications are real. Moynihan's decision to hire 1,000 contractors rather than permanently expand headcount suggests banks are treating AI's immediate demands as a surge to be managed, not a new baseline. For peers in financial services and beyond, the lesson is that AI adoption is not just a technology story. It is a capital allocation, workforce planning, and regulatory compliance story, and the companies that plan for the cleanup phase will be the ones that capture the efficiency gains without the whiplash.