BofA says it hired 1,000 contractors in Q2 to support 3,000 internal staff in patching proprietary and vendor software flaws exposed by AI models like Mythos

Software patching costs, once triggered by AI, now add hundreds of millions to financial institutions' expenses.

Bank of America has hired 1,000 external contractors in the second quarter to supplement its existing 3,000 internal staff tasked with patching software vulnerabilities. These flaws were exposed by advanced AI models, specifically mentioning Anthropic's Mythos. The bank's CEO, Brian Moynihan, stated in an interview that this defensive measure was a rapid response to the capabilities of new AI models released in April. The company incurred hundreds of millions of dollars in the third quarter for this software remediation, alongside anti-money laundering compliance efforts. Moynihan indicated that these remediation costs are expected to decrease over time as the patching is completed. In contrast, Bank of America's internal AI projects, numbering around 130, are projected to generate $700 million in savings next year, and the company has also reduced its overall headcount.

The significant investment in external contractors highlights the immediate and substantial costs associated with AI's dual nature: its potential to uncover vulnerabilities necessitates costly defensive measures. This indicates that the cybersecurity arms race is escalating, with AI not only a tool for innovation but also a potent new weapon for identifying exploitable weaknesses in legacy systems. Companies across sectors will need to allocate budgets for similar proactive and reactive security measures as AI capabilities mature.

This situation underscores a new category of operational risk and expenditure for businesses deploying or affected by advanced AI. While AI promises efficiency gains, the cost of securing systems against AI-driven threats, or even against the AI's own unintended consequences, is becoming a material factor in financial reporting. Investors and stakeholders will likely begin scrutinizing AI implementation not just for its revenue-generating potential but also for its associated security and compliance outlays.