BofA hires 1,000 contractors to fix AI-exposed flaws

Brian Moynihan provided a figure on Wednesday (14) that no other major bank had publicly shared: Bank of America hired 1,000 contractors in the second quarter to address software flaws exposed by advanced AI models like Anthropic's Claude Mythos. "We brought in 1,000 contractors to help with the remediation work in the second quarter, and these individuals are still with us, in addition to the 3,000 we have in this area," the CEO told CNBC after the third-quarter earnings call.

This effort encompasses code developed in-house as well as software purchased from vendors. According to Moynihan, BofA spent "several hundreds of millions of dollars, or more" in the quarter on software remediation and compliance with anti-money laundering regulations combined. The bank has not separated these two lines, so the figure does not provide a specific cost for Mythos.

The cost-cutting AI and the expensive AI

The same earnings report reveals another side of the equation. The headcount at the end of September stood at 209,911 people, nearly 3,500 fewer than a year earlier, according to the earnings material, which attributes the decline to process automation and job simplification. Moynihan explained that the bank no longer needs to fill all vacancies created by natural attrition and started 2026 with about 3,000 more employees than it currently has.

During the Q&A session, the CEO stated that the benefits from AI projects are expected to rise from approximately $300 million this year to about $700 million in 2027. The comparison with the 1,000 contractors makes it clear that the same technology that reduces administrative costs also incurs new expenses for security, both appearing in the same quarter.

Moynihan believes the latter expense is temporary. "Once you fix something, you won’t need to fix it as much. The flow will stabilize,” he stated. This is a reasonable thesis for the accumulated debt of legacy code, but it assumes that models won't continue to discover new flaws at the current rate, which no one in the industry can guarantee today.

The vendor on the other side of the table

The most discomforting statement from the interview was not about costs. "We must stay ahead of them, and we have to remember that those who develop the software are the ones trying to sell us the services," Moynihan said. For a CIO, this observation shifts the risk: a significant part of the flaws resides in third-party packages, and the bank needs to audit vendors who simultaneously provide solutions.

The quarter was weighed down for other reasons. The day prior, the U.S. Treasury announced a $1.2 billion penalty against the bank for failures in anti-money laundering efforts, with the OCC imposing $750 million credited against the FinCEN charge. Net income came in at $6.9 billion, or $0.91 per share; without the regulatory burden, it would have been $1.08, two cents below consensus estimates. Shares fell more than 7% on Wednesday.

Where the cost lands outside the U.S.

In Japan, the effect already has a destination. MUFG Bank, Sumitomo Mitsui Banking Corp., and Mizuho Bank negotiated access to Mythos in May, according to Bloomberg and Nikkei, after a meeting with U.S. Treasury Secretary Scott Bessent, and the Ministry of Finance established a public-private task force on the cybersecurity risks posed by these models. If BofA's pattern repeats, Japan's megabanks will face a similar queue of fixes in legacy systems, with one difference: they largely depend on local integrators to address this code.

In India, the approach focuses on labor supply. Moynihan’s comments on vendors directly apply to Indian integrators, who maintain American and European banking systems under long-term contracts. HCLTech announced a partnership with Anthropic on the 12th to bring Claude, Cowork, and Claude Code to corporate clients and reported advanced AI revenue of $219 million in the quarter, an increase of 78% in constant currency. Large-scale remediation is precisely the kind of demand these groups know how to meet, and it’s also the code they’ve written themselves.

The shared risk across these three markets is contractual before it is technical. Who pays for fixing a flaw discovered by AI in third-party software: the bank, the vendor, or the integrator maintaining the system? For now, BofA has absorbed the cost and hired people. The question that risk committees from other banks will bring up during contract renewals is whether this expense should continue to be borne by the purchaser.