In the second quarter, the consultants joined about 3,000 bank staff to fix flaws in the bank’s own code and in code from its vendors, and they are still at the bank.
Bank of America brought in 1,000 outside consultants in the second quarter to fix software security flaws exposed by the most powerful AI models, including Anthropic’s Mythos, CEO Brian Moynihan said. They work alongside about 3,000 of the bank’s own staff who were already doing that work.
Moynihan first told stock analysts about the 1,000 consultants on the bank’s Oct. 14 earnings call and described the work in a CNBC interview the same day. He said the cost of that work was part of “a couple of hundred million plus” in third-quarter expenses, but the bank did not disclose what share of that total went to the AI-related work.
The bank added the consultants after the most powerful AI models came out
Moynihan told CNBC that after the most powerful AI models came out, including Mythos, the bank’s leaders asked how to fix the flaws “quickly.”
“We put on 1,000 contractors to help us do the patching work in the second quarter, and those people remain here today, helping us, on top of the 3,000 people we have in that area,” he said.
CNBC reports that the work covers code the bank wrote itself and code it gets from its vendors. Moynihan told analysts the consultants are “not in the headcount,” meaning the bank does not count them as employees.
Background: Anthropic released Mythos only to a small group of organizations
Anthropic released Mythos in April to a small group of banks, technology firms, and government agencies. Anthropic limited the release because the model found thousands of security flaws, including flaws in every major operating system and web browser, and the company was concerned criminals could use the same abilities to attack. Anthropic said the organizations with access found at least 129,000 software flaws between April and July.
Neither Moynihan nor CNBC said whether Bank of America ran Mythos on its own code, or who found the flaws the bank is fixing.
The bank did not say how much the AI-related fixes cost
In the third quarter, the bank took a $1.2 billion charge to settle with regulators over its anti-money-laundering controls.
On the earnings call, Moynihan said “a couple of hundred million plus” in third-quarter expenses went to two things: fixing those money-laundering controls, and what he called “remediation for the Mythos implementation.” He did not say what he meant by “implementation,” and he gave no split between the two.
Earlier on the same call, when asked about the settlement, he said “a couple hundred million dollars plus” went to the money-laundering fixes alone. He did not reconcile the two statements.
Moynihan expects the cost of the AI-related fixes to fall
Moynihan told analysts he expects the Mythos costs to “run down” because the extra consultants are in place. “Once you patch, you don’t have to patch as much,” he told CNBC.
He did not say when the consultants would leave or when the work would be finished.
