Bank of America Says Patching Flaws Anthropic's Mythos Found Cost It 'A Couple Hundred Million Plus'
On its Q3 2026 earnings call, Bank of America CEO Brian Moynihan disclosed 1,000 contractors and hundreds of millions in costs tied to patching flaws Anthropic's Mythos model exposed — one of the first concrete megabank tallies of frontier-model dual-use risk.
Bank of America’s third-quarter earnings call produced one of the first concrete, dollar-and-headcount accountings of what it costs a major bank to defend itself against a frontier AI model’s ability to find software flaws.
Speaking to CNBC after the bank released its Q3 2026 results, CEO Brian Moynihan said Bank of America brought in 1,000 third-party contractors during the second quarter of 2026 to help patch vulnerabilities in its internal and vendor software — flaws that advanced AI models, including Anthropic’s Mythos, were able to surface. “We put on 1,000 contractors to help us do the patching work in the second quarter, and those people remain here today, helping us, on top of the 3,000 people we have in that area,” Moynihan told CNBC’s Leslie Picker (CNBC).
Earlier the same day, on the formal analyst call, Moynihan told investors the bank spent “a couple hundred million plus” in the third quarter on software remediation combined with regulatory work tied to anti-money-laundering compliance (CNBC). That call was held October 14, 2026, as listed on Bank of America’s investor relations site (Bank of America Investor Relations).
Why Mythos forced the scramble
Anthropic released Mythos in April 2026 to a small group of banks, technology companies and government agencies. The model’s ability to uncover decades-old flaws in proprietary and vendor code — the same skill that makes it valuable for defenders — also meant it could reveal exploitable weaknesses faster than banks could fix them. Moynihan described the response as urgent: “That risk is real risk, and that’s why when the frontier-type models came out … a lot of us sat down and said, ‘How do we figure out how to get through this quickly?’” he said (CNBC).
He also pointed to an awkward structural problem: the companies building the AI models capable of finding these flaws are frequently the same companies trying to sell banks software and services. “We’ve got to stay ahead of them, and we’ve got to be mindful that the people doing the software development are the people trying to sell us the services,” Moynihan said.
BofA isn’t alone in flagging this. JPMorgan CEO Jamie Dimon called Mythos-related risk a “real issue” back in July 2026, telling reporters that U.S. government officials were already focused on it (Benzinga).
A cost Moynihan calls temporary — alongside a separate AI savings story
Moynihan told analysts he expects the elevated remediation spending to ease: “Once you patch, you don’t have to patch as much … the pipeline moves through,” he said, per CNBC. At the same time, he said the bank’s roughly 130 internal AI projects are expected to generate savings that rise from $300 million this year to $700 million in 2027 — projects unrelated to the Mythos patching effort but illustrative of the same company booking both an AI-driven cost and an AI-driven savings line in a single quarter.
BofA’s head count fell by about 3,400 over the past year, including roughly 5% of its managers, though Moynihan did not specify how much of that reduction is attributable to AI-driven efficiency versus other factors.
The stock move has more than one cause
Shares fell as much as 8% intraday Wednesday, closing down 4.76% at $51.39, according to Benzinga. It would be a mistake to attribute that entirely to the patching disclosure: the same day, BofA reported adjusted earnings of $1.08 per share against a consensus estimate of $1.11, and revenue of $29.96 billion that missed the $30.69 billion analysts expected. The move also came a day after the U.S. Treasury announced more than $1.21 billion in penalties against the bank for failing to report over $5 billion in suspicious transactions (Benzinga). The Mythos remediation cost is one input among several, not a standalone explanation for the drop.
Why this matters beyond one earnings call
Moynihan’s comments are among the first specific, on-record numbers from a systemically important bank quantifying the defensive cost of a frontier model’s dual-use capability — a model good enough to help defenders is also good enough to help attackers, and the gap between those two uses now has a price tag attached: roughly 1,000 extra contractors, on top of an existing 3,000-person team, for a quarter that cost “a couple hundred million plus” combined with AML work. That is a concrete data point for any enterprise trying to budget around the security implications of adopting or being exposed to cyber-capable AI models, a theme Automater has tracked in coverage of the Mythos-class model era and in the push to airgap cyber-capable models by default.
It also sharpens a question enterprise security teams are increasingly asking: how do you evaluate a vendor’s AI-driven security offer when that same vendor’s models are the ones finding the flaws in the first place? Automater’s operator-focused guides on cyber capability access gates as emerging product SKUs and operating near the critical cyber threshold are directly relevant to teams facing the same incentive tension Moynihan described.
For now, Bank of America is treating the remediation spend as a temporary surge rather than a permanent cost center. Whether that holds — and whether other banks follow with their own disclosures — will say a lot about how the industry is actually pricing frontier-model risk, as distinct from how it markets frontier-model benefits.