The finding was automated. The fixing was not.
Mythos did the part of security work that scales. Pointed at Bank of America's systems, it surfaced vulnerabilities, some of them in code that had been running for years. What happened next did not scale at all. In the second quarter, the bank recruited 1,000 contractors to do the patching. They joined a much larger existing technology operation — roughly 3,000 staff in the relevant area, whose work is broader than Mythos findings alone. Months later, the contractors are still there.
The disclosure is unusual for a specific reason: it attaches a concrete staffing number to AI vulnerability discovery, where most organisations have quoted only how many flaws a model found. Bank of America said, on an earnings call, how many extra people it took to act on the findings. The model surfaced vulnerabilities at a scale that required more remediation capacity than the bank had, and the bank answered with 1,000 additional contractors. Remediation still runs at human speed, at contractor rates.
One number, two bills
Read the cost figure carefully, because some coverage has not. Moynihan put "a couple of hundred million plus" of third-quarter expense down to two things together: remediation for the anti-money-laundering orders and remediation for the Mythos implementation. He offered the combined number while answering a broader question about AI and the bank's expense base; nobody had asked him to price the Mythos clean-up on its own, and he gave no Mythos-only breakdown. The Register's report of the call notes the lumping explicitly.
So any headline that turns the full amount into the price of patching AI-found bugs is adding something the bank never said. The honest version is less tidy and more useful: the patching programme is large enough to need 1,000 contractors and to be named on an earnings call, and its exact cost sits inside a combined figure the bank chose not to open up. The regulatory penalties reported the same week, including a $1.21 billion FinCEN settlement, are a third thing again — fines, not fix-it spending — and folding them in would inflate the number further.
The benefit side has the same problem
The same call carried the bank's AI benefit figures: about 130 implemented projects, $250–300 million of benefits expected in 2026 and $700 million expected in 2027, each project individually assessed against a payback the bank puts at two to three times its cost over time, and an engineering workforce described as around 10% more efficient. Those are expectations, not audited savings, and the method behind the efficiency figure was not made public. That symmetry is worth sitting with. On one call, the cost of AI was a bundle and the benefit of AI was a projection, and neither came in a form an outsider could fully check.
None of this makes the disclosure weak. It makes it typical, and unusually honest about its own limits. The CEO expects the remediation costs to run down over time. A first pass through decades of code being the expensive one would explain that, but it is our reading, not a schedule the bank gave: it offered no timetable, and no separate forecast for the Mythos share or for the wider remediation workforce. What to watch is whether the contractor count actually falls in coming quarters, and whether any bank, this one included, ever publishes the split that this call left out. Until one does, the verified facts are the people: 1,000 contractors brought in, working alongside a broader technology workforce of about 3,000, still patching.
Sources
- [1] Bank of America, Q3 2026 earnings, 14 October 2026 — the earnings call on which the CEO made these remarks, and the bank's quarterly earnings materials (investor relations)Read source
- [2] The Register, "Bank of America had to bring in 1,000 contractors to patch all the bugs Mythos identified", 15 October 2026Read source
- [3] PYMNTS, "BofA Deploys Workers to Patch Vulnerabilities Found by Frontier AI", 15 October 2026Read source