Bank of America hired 1,000 contractors in the second quarter to patch software vulnerabilities exposed by advanced AI models, CEO Brian Moynihan told CNBC in a Wednesday interview, according to Quartz.
Moynihan said the contractors remained at work alongside 3,000 employees in that area when he spoke. Quartz reported that the effort covered both the bank’s own code and software supplied by vendors.
The report linked the patching work to vulnerabilities identified by models including Anthropic’s Mythos, which Quartz said Bank of America had access to.
Remediation costs and compliance spending
Quartz, citing CNBC’s coverage of the bank’s third-quarter earnings call, reported that Moynihan put quarterly spending on software remediation and regulatory issues related to anti-money-laundering compliance at a “couple hundred million plus.” The figure covered both areas, rather than software patching alone.
Moynihan told CNBC he expected remediation costs to ease as the work progressed, according to Quartz. He described the spending as temporary and said the need for additional patching would diminish as existing problems were addressed.
Moynihan also discussed the banks’ relationship with software providers. “We’ve got to stay ahead of them, and we’ve got to be mindful that the people doing the software development are the people trying to sell us the services,” he said in the CNBC interview, as quoted by Quartz.
Quartz separately reported that Bank of America’s shares fell as much as 8% on Wednesday.
Banks reportedly accelerated software repairs
Quartz reported, citing CNBC, that Anthropic made Mythos available in April, initially restricting access to selected banks, technology companies and government bodies. The publication identified Bank of America as one of the lenders given access to the model.
According to Quartz, U.S. banks accelerated their repair work after Mythos was released. By May, some remediation that might previously have waited weeks was being completed within days.
The publication said the number of vulnerabilities identified ranged from several hundred to thousands, with most classified as low to moderate in severity.