CHARLOTTE, N.C.—Bank of America has deployed 4,000 employees and contractors to address software vulnerabilities identified by advanced artificial intelligence models, including Anthropic’s Mythos, in one of the first public indications of the substantial costs financial institutions are incurring as AI exposes previously undetected cybersecurity weaknesses.
Bank of America CEO Brian Moynihan told CNBC the bank assigned 3,000 employees and hired an additional 1,000 contractors to identify and repair software flaws discovered by the increasingly sophisticated AI technology.
According to CNBC, the bank brought in the contractors during the second quarter, and they remain on the job. Moynihan said the additional spending is expected to decline as the vulnerabilities are corrected.
The disclosure comes as major financial institutions and federal regulators confront a new cybersecurity challenge: AI models capable of identifying weaknesses in computer systems, including flaws that have existed for decades, at speeds far beyond traditional security testing.
Those same capabilities could also be exploited by cybercriminals to launch attacks against banks, credit unions and other organizations.
“That risk is real risk, and that’s why when the frontier-type models came out … A lot of us sat down and said, ‘How do we figure out how to get through this quickly?'” Moynihan told CNBC.
JPMorgan CEO: Cyber Risks Increased Tenfold
Bank of America’s disclosure follows a warning from JPMorgan Chase CEO Jamie Dimon, who told Bloomberg Television on Oct. 6 that cybersecurity risks had increased tenfold following the introduction of Anthropic’s Mythos model.
Dimon said the technology has exposed vulnerabilities that financial institutions previously did not know existed.
“What we’re doing is rolling up our sleeves and going to work to fix it,” Dimon told Bloomberg.
The comments from the leaders of two of the nation’s largest banks underscore growing concerns about the potential for frontier AI models to fundamentally change cybersecurity risks across the financial services industry.
While the models can help institutions identify and correct weaknesses before they are exploited, they also potentially provide attackers with powerful new tools for discovering vulnerabilities.
More Than 10,000 Vulnerabilities Identified
Anthropic reported in May that its Mythos Preview model had identified more than 10,000 cybersecurity vulnerabilities across the 50 partner organizations that had access to the technology at that time.
The findings demonstrated the ability of advanced AI systems to uncover software weaknesses that had escaped detection through conventional security reviews.
Reuters reported in May that several large banks with access to Mythos were discovering vulnerabilities in their information technology systems and sharing findings with smaller institutions that did not have access to the model.
According to Reuters, the technology was also accelerating remediation efforts, with banks addressing some vulnerabilities in days rather than the weeks previously required.
That development presents both opportunities and challenges for financial institutions, particularly smaller banks and credit unions that may lack the technology budgets and specialized cybersecurity personnel available to the nation’s largest banks.
Treasury Coordinating Industry Response
The potential threats have also drawn the attention of federal financial regulators.
According to PYMNTS, a Treasury Department spokesperson said in April that Treasury Secretary Scott Bessent had convened a meeting of regulators and financial institutions to coordinate a response to rapid advances in AI capabilities.
The department indicated that it planned to continue holding such meetings as the technology evolved.
The coordination reflects concerns that vulnerabilities discovered through advanced AI could create risks extending beyond individual institutions, particularly if weaknesses are present in widely used software or financial technology systems.
Costs of AI Security Efforts Emerging
Moynihan’s disclosure offers one of the first indications of the resources major financial institutions are committing to respond to the new generation of AI-driven cybersecurity threats.
Bank of America did not disclose a specific dollar amount associated with the additional 1,000 contractors, according to CNBC, but the staffing commitment illustrates the scale of the remediation effort.
