Claude Mythos at Bank of America: 1,000 contractors patch flaws

On October 14, Bank of America CEO Brian Moynihan told CNBC that the bank had hired about 1,000 outside contractors just to patch software flaws found by AI models, including Anthropic’s Claude Mythos.

Claude Mythos at Bank of America: what actually happened?

While discussing third-quarter results, Moynihan described how the bank is dealing with the flaws that new models keep turning up. According to ITPro and The Next Web, with more in the CNBC interview:

1. 1,000 contractors joined in the second quarter, working alongside roughly 3,000 bank employees who were already doing the same job.
2. The flaws sit in the code of the bank and its vendors, not only in internal systems.
3. Cost: Moynihan spoke of “a couple hundred million dollars plus” per quarter, but that figure also covers fixes to anti-money-laundering procedures, so it isn’t purely the Mythos bill.

“We put on 1,000 contractors to help us do the patching work in the second quarter,” Moynihan said, adding: “Once you patch, you don’t have to patch as much.” In other words, at least in his view, the bank is past the worst of it. I do wonder, though, whether this is only the beginning…

Claude Mythos

Claude Mythos is an Anthropic model you can’t simply buy access to, not even through the API. The company introduced it on April 7, 2026 as part of Project Glasswing, a program meant to put its capabilities to work for defense before attackers get there first.

Anthropic says outright that Mythos “can surpass all but the most skilled humans at finding and exploiting software vulnerabilities” and that it has already found thousands of serious flaws in major operating systems and browsers. For now, the company has no plans to make it publicly available.

Access went to launch partners (including AWS, Apple, Google, Microsoft, NVIDIA, CrowdStrike and JPMorganChase) and to more than 40 organizations that maintain critical software infrastructure.

Why is everyone talking about it?

Because this is a key moment for our cybersecurity. When an AI model’s capabilities translate into a very concrete number of jobs and dollars, we can talk about how serious the situation really is. And Bank of America is not an exception:

1. According to The Next Web, in May Jamie Dimon said that hundreds of people at JPMorgan Chase were working on this full time.
2. About a month after Glasswing launched, US regulators paused some cybersecurity exams to give the largest banks time to fix what the model had found.

Interestingly, Moynihan also pointed at vendors: “the people doing the software development are the people trying to sell us the services.” In other words, the flaws are (of course) also in software the bank buys from others (I wrote about how European regulators are looking at the big AI labs in my post on AI Act enforcement).

One caveat worth keeping in mind: The Next Web notes that it did not independently verify the number of contractors or the costs, and the reports say nothing about how severe the flaws were.

FAQ

Can you use Claude Mythos?

Not in the usual way. Mythos Preview is available only to Project Glasswing partners and selected organizations, and Anthropic has no plans to release it publicly.

How many people did Bank of America hire to patch flaws?

About 1,000 outside contractors in the second quarter of 2026, alongside roughly 3,000 of its own employees.

How much did it cost?

According to Moynihan, “a couple hundred million dollars plus” per quarter, but that figure also includes work on compliance with anti-money-laundering rules.