BofA says it hired 1,000 contractors in Q2 to support 3,000 internal staff in patching proprietary and vendor software flaws exposed by AI models like Mythos
Bank of America has hired an army of external contractors to help it patch software vulnerabilities exposed by advanced artificial …
Context & Ripple Effects
Banks’ AI agenda has emphasized automation: Goldman Sachs described work with Anthropic on agents for trading, transactions, client vetting and onboarding in February. BofA’s remediation effort adds a security-cost counterweight to that banking-agent push.
The security ecosystem was already adapting to AI-generated volume, with bug-bounty programs tightening researcher checks and deploying AI triage for low-quality reports. Anthropic’s reported verified-vulnerability totals and US regulators’ questions about banks’ agentic-AI safeguards put BofA’s staffing decision in a broader operational-risk frame.
First-order effects
- Bank of America is expanding the workforce available to remediate flaws in its proprietary software and third-party products, with 1,000 contractors supporting 3,000 internal staff.
- The vendors whose software is implicated face a larger, bank-driven demand for patches and coordination with BofA’s remediation teams.
Second-order effects
- For banks evaluating agentic systems, BofA’s staffing scale makes security remediation a material implementation requirement alongside the promised automation of internal workflows.
- The effort gives banking regulators a concrete example of the controls and resourcing banks may need to demonstrate as they question autonomous-system safeguards.
Third-order effects
- If AI systems continue to increase vulnerability discovery, financial firms’ AI spending will shift beyond model deployment toward recurring patching, triage and systems-integration capacity.
- The advantage in financial-services AI may increasingly depend on whether a bank can absorb and govern the remediation workload across both in-house and vendor software.
The trend: AI is turning software security from a periodic compliance function into a labor- and integration-intensive operating requirement for banks adopting autonomous systems.