Bank of America has hired approximately 1,000 contractors to help fix software vulnerabilities identified through advanced artificial intelligence tools, including Anthropic’s Mythos. The move highlights the growing cybersecurity challenges facing financial institutions as AI systems become increasingly capable of uncovering weaknesses in complex software.
The additional contractors were brought in during the second quarter of 2026 to support an existing team of approximately 3,000 employees working on software remediation. The expanded workforce is helping the bank identify, prioritise and repair vulnerabilities across its internal systems and third-party software.
The development underscores a growing concern for businesses worldwide: while artificial intelligence can accelerate vulnerability detection, organisations still need substantial human expertise and resources to address the problems uncovered.
Anthropic’s Mythos Raises Cybersecurity Concerns
Anthropic’s Mythos is an advanced AI model with powerful software analysis and cybersecurity capabilities. Its ability to identify weaknesses in computer systems has attracted attention from financial institutions and technology companies seeking to strengthen their digital defences.
Such capabilities offer significant benefits to security teams. Vulnerabilities that might otherwise remain hidden can be discovered more quickly, allowing organisations to address potential threats before attackers exploit them.
However, the same technology also presents risks. If advanced AI systems can identify software weaknesses efficiently, malicious actors could potentially use similar capabilities to develop attacks against vulnerable networks and applications.
For banks, the stakes are particularly high. Financial institutions manage sensitive customer information, payment infrastructure, digital banking platforms and systems responsible for processing millions of transactions. A successful cyberattack could expose confidential data, disrupt services and create substantial financial losses.
Bank of America’s expanded remediation effort reflects the importance of responding quickly to vulnerabilities uncovered by increasingly sophisticated AI tools.
1,000 Contractors Join an Existing Team
The 1,000 contractors were hired to supplement approximately 3,000 existing employees involved in software remediation. The expanded workforce gives the bank additional capacity to work through vulnerabilities and implement necessary security updates.
Fixing software flaws involves considerably more than identifying them. Security teams must establish which systems are affected, assess the severity of each vulnerability, determine whether it can be exploited and develop an appropriate patch.
The fixes must then be tested to ensure they resolve the original problem without introducing additional vulnerabilities or disrupting essential banking services.
These tasks can become especially complicated in large organisations operating extensive technology infrastructure. Banks often rely on legacy applications, interconnected databases and software supplied by multiple vendors. A single vulnerability may affect several systems, requiring coordination between different engineering and security teams.
The additional contractors can help accelerate this process by increasing the number of specialists available to investigate and repair affected software.
However, expanding the workforce does not automatically eliminate cybersecurity risks. The effectiveness of the effort depends on identifying the most serious weaknesses, implementing reliable fixes and verifying that systems remain secure after updates are deployed.
Remediation Adds to Technology Spending
Bank of America’s cybersecurity work comes alongside other operational and regulatory expenses. During its third-quarter earnings discussion, the bank referred to spending of several hundred million dollars on software remediation and anti-money-laundering compliance activities combined.
The combined figure does not represent the confirmed cost of repairing vulnerabilities identified by Mythos alone. Nevertheless, it illustrates the financial demands associated with maintaining secure systems while meeting regulatory obligations.
The bank expects remediation expenses to decline as its existing backlog of vulnerabilities is addressed. Once the most pressing issues have been resolved, the immediate workload associated with those specific flaws should ease.
However, cybersecurity is an ongoing process rather than a one-time project. Software updates, new applications and newly discovered vulnerabilities can create additional work even after an existing backlog has been cleared.
The growing capabilities of AI models could further increase the volume of vulnerabilities organisations need to investigate, placing additional pressure on technology budgets and security teams.
AI Creates Both Opportunities and Risks
The situation highlights the dual role artificial intelligence is beginning to play in cybersecurity. AI-powered tools can help organisations detect weaknesses, analyse code and strengthen their defences. At the same time, these systems may make it easier for attackers to discover exploitable flaws.
Anthropic introduced Mythos Preview in April 2026 through Project Glasswing, an initiative designed to help selected organisations use advanced AI capabilities to identify and address cybersecurity vulnerabilities.
The initiative reflects growing concern that increasingly capable AI models could change the speed and scale of cyberattacks. Giving defenders access to these capabilities may help them identify weaknesses before malicious actors can exploit them.
Nevertheless, vulnerability discovery is only one part of effective cybersecurity. Organisations must also maintain reliable patching processes, monitor their networks, train employees and establish procedures for responding to incidents.
Human expertise remains essential for evaluating AI-generated findings, determining their practical significance and ensuring that remediation efforts do not compromise critical systems.
What It Means for the Banking Industry
Bank of America’s decision to hire additional contractors demonstrates how AI-driven vulnerability detection can create an immediate demand for cybersecurity specialists.
Other financial institutions may face similar challenges as advanced AI tools become more widely available. Banks with limited security teams could struggle to investigate large numbers of vulnerabilities, particularly when their systems depend on third-party software providers.
The development also illustrates the importance of cooperation between technology companies, financial institutions and software vendors. Vulnerabilities discovered in widely used products may require coordinated fixes across multiple organisations.
For Bank of America, the immediate objective is to repair identified flaws and strengthen its technology infrastructure while continuing to deliver essential financial services.
As AI-powered cybersecurity tools evolve, banks will need to balance the benefits of faster vulnerability detection against the costs and complexity of fixing the problems they uncover. The hiring of 1,000 contractors demonstrates that even when artificial intelligence accelerates the discovery process, securing large-scale software systems remains a significant human and financial undertaking.
