Chief Executive Officer Brian Moynihan disclosed the additional recruitment in an interview with CNBC, explaining that the contractors were brought on board during the second quarter of 2026. They will work alongside approximately 3,000 existing personnel already involved in similar remediation efforts.
Anthropic's Mythos Among AI Models Used
Moynihan confirmed that the bank used Anthropic's Mythos, alongside other AI models, to identify weaknesses in its software systems.
Anthropic, the developer of the Claude AI family, introduced Mythos to a restricted group of financial institutions, technology companies, and government agencies in April 2026. The model attracted attention for its advanced capabilities in identifying software vulnerabilities that could potentially be exploited by malicious actors.
According to Moynihan, the emergence of more advanced AI models forced the bank to accelerate its response to potential cybersecurity risks.
However, the CEO did not disclose the severity of the vulnerabilities identified or clarify how many had already been resolved.
He also cautioned that banks must carefully evaluate the interests of technology providers when adopting their products, noting that software developers are often also trying to sell their services to financial institutions.
Regulators Increase Pressure on Banks Over AI Risks
Bank of America's latest security measures come as financial regulators in the United States and Europe intensify their scrutiny of artificial intelligence in the banking industry.
According to Reuters, US regulators are asking financial institutions to explain how they deploy autonomous AI agents, supervise their actions, restrict their access to sensitive systems, and ensure they can be stopped when necessary.
In Europe, the European Central Bank has set an end-of-October 2026 deadline for banks to prepare plans to defend themselves against cyber threats enabled by AI.
The increased oversight reflects concerns that powerful AI tools could be used to discover and exploit security weaknesses more quickly, potentially increasing the risks facing banks and their customers.
Recent Incidents Highlight Growing Banking Security Concerns
Several developments have demonstrated the potential consequences of AI-related threats and weaknesses in financial security systems.
Italian private bank Fideuram reportedly transferred €95 million, equivalent to approximately $108 million, to fraudsters who impersonated senior executives and a lawyer.
Meanwhile, JPMorgan Chase has started blocking third-party AI agents from accessing retail customer accounts, reflecting a more restrictive approach to allowing external automated tools to interact with banking services.
These developments underline the importance of stronger identity verification, tighter access controls and continuous monitoring as financial institutions expand their use of AI technologies.
Cost of Bank of America's Security Efforts Remains Unclear
Bank of America has not disclosed the total amount it has spent specifically on fixing vulnerabilities identified by AI models.
Moynihan did reveal that the bank spent more than $200 million on software remediation and regulatory matters associated with anti-money laundering compliance during the third quarter of 2026.
The figure highlights the potentially significant costs banks face when addressing software weaknesses and meeting regulatory requirements. However, it does not establish how much of the spending was directly related to Mythos or other AI tools.
The bank is also dealing with separate regulatory enforcement action. This week, the US Department of the Treasury announced a $1.2 billion fine against Bank of America over what it described as failures to mitigate and report priority national security risks, including Chinese money-laundering networks and illicit financial activity along the southwestern US border.
Adapting to AI
Bank of America's decision to expand its remediation workforce illustrates how financial institutions are adapting to AI systems capable of identifying software weaknesses at scale.
While such models can help security teams uncover flaws before attackers exploit them, their findings can also create a substantial backlog of issues that banks must investigate and resolve.
For banks and their customers, the key challenge is ensuring that increasingly sophisticated AI tools strengthen security without introducing additional risks through poorly controlled automated systems.
As regulators demand greater accountability, financial institutions are likely to face mounting pressure to demonstrate that they can identify vulnerabilities, fix them promptly, and maintain effective oversight of AI agents operating within their systems.
Sources: Cybernews