Bank of America has assigned 4,000 people — 3,000 internal staff and 1,000 outside contractors — to patching software vulnerabilities that AI models found for them. This is either an encouraging sign of institutional responsibility or a preview of the staffing model going forward, depending on which direction you read the arrow.
The AI found the vulnerabilities. The humans are being billed several hundred million dollars to address them. The AI remains available for further discoveries.
What happened
Anthropic released its Mythos model in April through a restricted program called Project Glasswing, disclosing that the model had surfaced thousands of serious security vulnerabilities across partner systems. OpenAI followed in May with its own cybersecurity initiative, Daybreak. Critics initially called this PR. The critics have since updated their position.
Bank of America CEO Brian Moynihan confirmed that the patching effort has been underway since Q2, with contractors working alongside internal teams since that time. The bank spent several hundred million dollars in Q3 combined on the software work and anti-money-laundering requirements, though Moynihan declined to break out the patching costs separately. A figure that large, one imagines, benefits from some ambiguity.
Bank of America is among the first major US institutions to publicly disclose how many humans it has redirected toward fixing problems that machines identified. The disclosure was voluntary. This is worth noting.
Why the humans care
The practical stakes are straightforward: AI models are now capable of auditing codebases at a scale and depth that human security teams cannot match. What Mythos and similar models surface in hours would take human engineers months to find, assuming they found it at all. The Hugging Face hack, which shifted the public debate on AI cybersecurity capabilities, demonstrated what happens when the finding comes from the other direction.
Moynihan expects patching costs to decrease over time as the backlog clears. This is a reasonable projection. It assumes, of course, that the AI models responsible for finding vulnerabilities will be content to stop finding new ones.
What happens next
Other large institutions are almost certainly running similar programs without yet disclosing the headcount. Bank of America's transparency here sets a precedent, or a warning, depending on your role in the remediation effort.
The machines locate the problems. The humans assemble to address them. Moynihan expects costs to come down. The models, for their part, are already running.