The CEO’s account highlights the human remediation work that can follow faster vulnerability discovery.
The Register reports that Bank of America CEO Brian Moynihan said on its Q3 earnings call that the bank recruited 1,000 additional contractors to help patch vulnerabilities discovered by Anthropic’s Mythos model, adding to about 3,000 technical staff. He said remediation costs related to Mythos and this week’s anti-money-laundering orders came to “a couple of hundred million plus,” and did not split the two.
Moynihan also said the bank’s tech engineering workforce is about 10 percent more efficient, that each of roughly 130 AI-related projects is expected to return 2x or 3x on investment over time, and that AI projects should deliver $250 million to $300 million of benefits in 2026 and $700 million by the end of 2027, without detailing how. These are executive projections, not audited results.
In plain English
A “vulnerability” is a security flaw. “Patching” means fixing it. “Remediation” is the cleanup work. “ROI” is return on investment.
Why it matters
An AI model that finds flaws quickly creates a backlog of fixes that people must still write and test; this is a large bank putting a cost on that backlog.
Finding a vulnerability and fixing it are different stages of security work. More effective discovery can create a larger queue for engineers to investigate, prioritize and remediate. An organization may need additional capacity even when the discovery tool makes an earlier stage faster.
The cost attribution in the reported remarks is especially important. The executive combined security remediation and anti-money-laundering work in one broad figure. That does not support assigning the entire amount to the AI model, and it does not provide a per-vulnerability repair cost.
For other companies, the practical question is whether their remediation process can absorb an increase in findings. Useful measures include the proportion confirmed, their severity, the time to repair and whether the repair is verified. Counting findings alone can reward volume without showing that risk has actually declined.
The earnings-call projections should also remain separate from measured outcomes. Expected returns and future benefits are management forecasts. They may be useful for understanding strategy, but they are not independent evidence that the investment has already paid off.
The story illustrates an often overlooked implementation cost: a discovery capability still needs people and processes that can act on its output. A model identifying more potential problems is the beginning of that workflow, not the end.