Bank of America deploys 4,000-strong team to fix AI-flagged flaws

By Sophie Lindqvist

Bank of America has assigned roughly 4,000 people — including 1,000 outside contractors — to fix software vulnerabilities uncovered by AI models such as Anthropic's Mythos, according to CNBC.

The figure is one of the largest publicly disclosed remediation workforces tied to AI-driven code review at a major U.S. bank. It also gives a concrete sense of how much manual work still sits behind even the most automated security pipeline.

What's actually in the CNBC report

The public summary of CNBC's story is short. Bank of America brought in 1,000 outside contractors specifically to address vulnerabilities that models such as Anthropic's Mythos had flagged. Combined with internal staff, the total response team numbers around 4,000.

The original CNBC piece, which The Decoder cites, will likely carry more detail on timelines, the kinds of flaws involved, and how the bank is sequencing the work. None of those specifics are in the brief write-up that surfaced this week. What is clear is the shape of the operation: a flag-and-fix pipeline, run at scale, with humans doing the closing work.

What Anthropic's Mythos appears to be

Anthropic is the AI lab behind the Claude family of models. Mythos, per CNBC's framing, is one of the new generation of tools the bank is using to comb through source code in search of exploitable flaws. It belongs to a class of AI systems that read code, flag suspect patterns, and rank them for human review.

These tools have moved from research curiosities to enterprise plumbing over the last two years. Banks, cloud providers, and defense contractors now treat them as standard parts of the security toolkit, alongside human reviewers and traditional static analyzers.

The model itself isn't doing the patching. It does the reading. The hard part — writing the fix, testing it, shipping it through regulated change-management — still falls to humans. That's why the headcount balloons.

Why the fix side is so labor-heavy

Bank of America's internal codebase isn't a single app. It's the accumulated weight of a major U.S. bank: decades of mergers, online banking platforms, trading systems, fraud tools, and compliance pipelines stitched together over time.

When Mythos or a peer model flags a flaw in that stack, the fix is rarely local. It touches multiple services, may cross regulated boundaries, and almost always needs a re-test cycle before going live. A finding that an AI surfaces in seconds can take an engineer days to close properly.

The 1,000 outside contractors handle the bulk of that day-to-day remediation, per CNBC. Internal staff focus on the architecture-level calls — what to fix first, what to defer, where the model might be wrong.

The headcount in context

Four thousand people is roughly the staff of a mid-size software company. It's also a notable jump from where bank security teams sat a decade ago, when a typical large-bank cybersecurity group numbered in the low hundreds.

Several forces are pushing that number up at once. AI tools flag more issues than legacy scanners did. Regulatory pressure for faster patching has kept rising. The codebase itself keeps growing. The result is a remediation backlog that won't shrink on its own — exactly the kind of problem contractors get hired to clear.

What it signals about the labor market

Cybersecurity contractors have been a tight market for years. Pulling 1,000 of them into one bank's queue tightens it further. Smaller banks, fintechs, and defense contractors all compete for the same talent pool.

That's a second-order effect of the AI flagging story the CNBC report tells. The model surfaces more work than a bank could have identified on its own. Someone still has to do that work.

Wages for vetted security contractors have already climbed over the past two years. A hiring spree of this size, even a temporary one, adds fresh pressure on both sides of the market.

The forward question

The 4,000-person figure is a snapshot of one bank's response at one moment. It will shrink as the immediate backlog clears.

The more durable pattern is the flag-and-fix structure itself. Once a bank proves the workflow works, every other large enterprise with a real codebase is likely to copy it. Watch the next round of disclosures — financial filings, vendor earnings calls, regulator reports — to see whether the headcount becomes the norm or recedes.

Bottom line: AI found the flaws. The humans are still doing the closing work, and Bank of America has hired more of them than almost any peer bank has been willing to admit.