First implication: Model-driven vulnerability discovery can create a remediation-capacity problem, not just a tool-selection problem.
This starts a distinct analytical record because no prior New Runtime analysis of this specific bank remediation effort is supplied.
Thesis
Frontier-model capability can turn latent software weaknesses into an immediate remediation workload for large operators, even when the models did not attack the operator.
Observed facts
Bank of America hired 1,000 external consultants in the second quarter to help patch software, and CEO Brian Moynihan said they remained alongside 3,000 staff in the area.
1Moynihan described more than a couple hundred million dollars in combined spending on software fixes and anti-money-laundering compliance issues, without separating the cybersecurity portion.
1
Mechanism
More capable models can expose weaknesses in code that ordinary review has not surfaced; organizations then need people to triage, patch, and verify those findings across internal and vendor-used software.
Why now
The bank’s reported hiring followed executives’ concern about frontier models such as Anthropic’s Mythos and was described as ongoing, not a hypothetical future plan.
Implications
Model-driven vulnerability discovery can create a remediation-capacity problem, not just a tool-selection problem.
Evidence boundary
The report does not identify the flaws, attribute their discovery to a specific model, quantify security-only costs, or document the fixes’ effectiveness.
Watch conditions
Watch for disclosure of the vulnerability classes found, the verification process, or evidence that the contractor effort reduced exploitable exposure.