Bank of America expands its software patching effort

The contractors joined during the second quarter and were still working at the bank when Moynihan spoke.[1] They supplemented 3,000 people already working in the bank’s patching area.[1] Moynihan said the bank mobilized thousands of employees and outside contractors this year for the software work.[2] The effort is not limited to code written by Bank of America: it also covers software supplied by vendors.[2] For teams planning remediation, that means keeping internal and vendor-related work in view when considering the scale of the effort.[2]

Anthropic made its Mythos model available in April to a small group of banks, technology firms and government agencies, and Bank of America was among the lenders with access.[1][2] By May, banks were completing some vulnerability remediation within days rather than the weeks they might previously have taken.[2] The number of flaws identified ranged from several hundred to thousands, while most were rated low to moderate in severity.[2] Those details point to a broad workload, but they do not establish that every identified flaw was severe or that every fix was completed at the same pace.[2]

Bank of America spent “a couple hundred million plus” in the third quarter on software remediation and anti-money-laundering regulatory issues.[1] Moynihan did not break down how much of that spending went to AI or Mythos, rather than anti-money-laundering issues.[3] He expects the bank’s remediation costs to decline over time.[1] The figures therefore offer a view of combined spending and management’s expectation, but not a specific AI remediation budget.[1][3] Teams assessing the cost of AI-related security work should keep that distinction clear.[3]

Moynihan called the vulnerabilities a real risk and said banks need to stay ahead of threats while remaining mindful that software developers also sell banks their services.[2][1] Bank of America shares fell as much as 8% on Wednesday, the day the article was published.[1] The reported share movement does not, by itself, establish a cause. The evidence also does not specify how much of the bank’s remediation work was driven by AI tools, or how the contractors’ work was divided between the bank’s code and vendor software.[2][3] Those are useful limits to preserve when communicating about the effort.