Bank of America added 1,000 external contractors in the second quarter to help patch proprietary and vendor software flaws exposed by advanced models including Anthropic’s Mythos. The contractors remained alongside 3,000 internal staff in that area. These are reported facts from CNBC’s account of CEO Brian Moynihan’s comments.
First implication: Organizations facing a similar backlog may need to treat vulnerability remediation capacity as a real operating cost of frontier-model capability, not just a security-team concern. The same source says savings from about 130 internal AI projects are expected to rise from $300 million this year to $700 million in 2027, but it does not show that these projects offset remediation spending. First watch condition: Whether Bank of America later reports remediation costs separately and confirms that they decline as the patching pipeline clears. This is a distinct analytical record because no prior New Runtime record was supplied; it documents measurable remediation labor and spend, not a general account of model security.
Thesis
Frontier-model vulnerability discovery can create a near-term remediation workload that is material enough to require dedicated external staffing.
Observed facts
Bank of America said it added 1,000 external contractors in the second quarter to help patch software vulnerabilities.
1The contractors remained alongside 3,000 internal staff in that area.
1Third-quarter spending of “a couple hundred million plus” combined software remediation and anti-money-laundering compliance issues.
1
Mechanism
The bank expanded patching capacity with contractors and internal staff to work through identified software vulnerabilities; Moynihan described the pipeline as temporary, with costs expected to decline as patches are completed.
Why now
The disclosure supplies headcount and spending details after the bank’s third-quarter earnings, rather than only a general warning about AI-enabled cyber risk.
Implications
Organizations facing a similar backlog may need to treat vulnerability remediation capacity as a real operating cost of frontier-model capability, not just a security-team concern.
The bank’s projected internal AI savings are a separate figure and are not shown to offset remediation spending.
Evidence boundary
The reported third-quarter “couple hundred million plus” covered software remediation and anti-money-laundering compliance issues together, so the source does not establish the remediation-only bill or attribute all flaws to Mythos.
Watch conditions
Whether Bank of America later reports remediation costs separately and confirms that they decline as the patching pipeline clears.