Bank of America Mobilizes Army of Contractors to Counter Advanced AI Cybersecurity Threats, CEO Says

Bank of America has hired an army of external contractors to help patch software vulnerabilities exposed by advanced artificial intelligence models, including Anthropic’s powerful Mythos system, the bank’s Chief Executive Officer Brian Moynihan revealed during a recent interview.

Speaking with CNBC’s Leslie Picker following the release of the bank’s third-quarter earnings report, Moynihan detailed how the financial institution rushed earlier this year to bolster a wide spectrum of its internal and vendor code. To tackle the sudden and intense technical challenge, the bank deployed thousands of internal employees alongside a massive contingent of outside personnel.

The aggressive defensive maneuver underscores a rapidly evolving reality for global financial institutions: while frontier artificial intelligence models offer unprecedented capabilities for efficiency and automation, their sophisticated analytical power can also uncover and exploit decades-old software flaws at terrifying speeds. This dual-edged nature of modern technology has forced major corporations into costly, preemptive software security scrambles to safeguard critical financial infrastructure.

Reflecting on the emergence of these advanced systems, Moynihan noted that the threat landscape shifted dramatically when new frontier-type models were introduced to the market. Acknowledging the gravity of the situation, leadership across the firm recognized the urgent need to address potential vulnerabilities before they could be leveraged by malicious actors or exposed by automated auditing tools.

"That risk is real risk, and that’s why when the frontier-type models came out, a lot of us sat down and said, ‘How do we figure out how to get through this quickly?’" Moynihan told CNBC during the post-earnings discussion.

To meet the challenge head-on, the bank dramatically scaled up its technical workforce. According to the chief executive, Bank of America brought on 1,000 external contractors in the second quarter specifically to assist with the rigorous code-patching process. Those contractors remain with the institution, working alongside an already dedicated team of 3,000 internal professionals focused on the same critical domain.

The financial impact of these security operations has been substantial. Moynihan disclosed to analysts earlier on Wednesday that the bank spent a "couple hundred million plus" during the third quarter alone. These expenditures covered comprehensive software remediation efforts alongside regulatory compliance tasks related to anti-money laundering protocols.

Moynihan’s remarks represent some of the earliest public acknowledgments by a major U.S. corporation detailing the exact manpower and financial resources required to protect enterprise software systems from advanced models like Anthropic’s Mythos. The high-stakes model was initially released earlier this year to a tightly controlled, small group of financial institutions, technology firms, and government agencies to test vulnerabilities and strengthen digital defenses.

The revelations from Bank of America’s leadership throw a sharp spotlight on the complex dilemma facing corporate technology executives. Organizations are tasked with staying ahead of sophisticated AI-driven code analysis tools while simultaneously navigating vendor relationships with the very developers creating these disruptive technologies.

"We’ve got to stay ahead of them, and we’ve got to be mindful that the people doing the software development are the people trying to sell us the services," Moynihan remarked, pointing to the delicate balance firms must strike as artificial intelligence permeates every layer of the corporate software ecosystem.

The discussion surrounding these substantial cybersecurity and compliance investments coincided with a challenging day for the bank’s stock on the public markets. Bank of America shares slumped by as much as 8% following the release of the third-quarter financial results. Despite the market reaction and the heavy outlays required for software remediation, Moynihan sought to reassure investors that the surge in defensive spending is a temporary, front-loaded necessity rather than a permanent structural increase in operating costs.

Explaining the trajectory of the remediation cycle, the CEO emphasized that the intensive patching phase is designed to clear out historical vulnerabilities systematically. Once the backlog of older code is thoroughly reviewed and secured, the ongoing maintenance burden is expected to normalize significantly.

"Once you patch, you don’t have to patch as much. The pipeline moves through," Moynihan said, expressing confidence that remediation expenditures will taper off over time as the bank stabilizes its digital architecture against next-generation AI threats.

Even as advanced artificial intelligence creates new cost centers through defensive security requirements, the technology continues to deliver substantial financial savings elsewhere across Bank of America’s vast operations. Moynihan highlighted that the institution is actively running approximately 130 internal artificial intelligence projects designed to streamline workflows, enhance productivity, and reduce operational overhead.

Financial returns from these internal automation and AI initiatives are scaling rapidly. According to projections shared with analysts during the earnings call, savings generated by the bank’s internal artificial intelligence projects are expected to rise from $300 million this year to an anticipated $700 million by 2027.

These technological integrations and efficiency drives coincide with broader workforce adjustments across the enterprise. Bank of America’s total headcount decreased by approximately 3,400 employees over the past year. During this period, the firm executed targeted reductions, cutting roughly 5% of its managerial positions. While the bank continues to optimize its organizational structure through technology and staffing adjustments, leadership has not explicitly specified the exact proportion of these workforce reductions that can be directly attributed to the deployment of internal artificial intelligence systems.