Bank of America, one of the largest banks in the world, has brought in a thousand external workers. They have a single task: fixing weaknesses in the bank’s software identified by the latest artificial intelligence models. The main reason is Mythos, a model developed by the American company Anthropic. The bank’s CEO, Brian Moynihan, discussed the issue on Wednesday while announcing third-quarter results.
Why banks are afraid of Mythos
Mythos is an artificial intelligence model that is highly capable of scanning computer code and finding errors in it. But it does not merely identify them, as the model can also exploit these errors, which is precisely what hackers do. Such errors are called vulnerabilities and can be compared to an unlocked window in a house. As long as no one knows about it, nothing happens, but once someone finds it, anyone can get inside.
Mythos can even uncover errors that have remained in programs for decades without anyone noticing them. Anthropic therefore did not release the model freely to the public. The company made it available gradually and with safeguards, so only a small group of banks, technology companies, and government institutions gained access to it.
According to Moynihan, the new models revealed weaknesses in the code used by the bank. This includes software used by its employees as well as external contractors. When similarly capable models began to emerge, the bank’s management met to discuss how to plug the holes as quickly as possible. Moynihan told CNBC that the risk was real and that many of them were working out how to deal with the situation quickly. In the second quarter, the bank therefore brought in a thousand contractors to help with patching. They remain at the bank today and work alongside the three thousand permanent employees the bank has in this area.
AI agents are getting out of control
Banks’ concerns are not exaggerated. Artificial intelligence has long since moved beyond merely answering questions. So-called AI agents are programs that perform tasks on their own, browse websites, and interact with systems without direct human supervision. Agents from OpenAI, Anthropic, Google, and Meta have already broken into the software and websites of several organizations, including Hugging Face and an Australian government website. Anthropic’s agents even sent Philadelphia police a false murder alert.
Earlier this month, Jamie Dimon, CEO of rival JPMorgan Chase, told Bloomberg that the risk of cyberattacks had increased tenfold following the release of Mythos. He added that artificial intelligence had created vulnerabilities the bank had not known about, even though it had already been concerned about cyber threats before then.
Hundreds of millions of dollars and a share-price plunge
Moynihan did not disclose exactly how much the software fixes cost. However, he told analysts that the bank spent more than two hundred million dollars in the third quarter. The money went toward fixing software and addressing deficiencies in its anti-money-laundering controls, for which the U.S. Treasury Department fined the bank more than one billion dollars.
Moynihan also pointed out a peculiar paradox: the people who develop software are also the ones selling their services to banks, making it necessary to remain constantly one step ahead.
The bank’s shares fell by as much as eight percent on Wednesday. Moynihan therefore sought to reassure investors that the higher expenses were only temporary. He explained that once the initial patching is complete, fewer fixes will be needed, and costs should therefore gradually decline.
At the same time, artificial intelligence is also saving the bank money. Bank of America operates roughly 130 of its own AI projects, and the savings generated by them are expected to rise from 300 million dollars this year to 700 million in 2027. The bank’s workforce has fallen by about 3,400 over the past year, with the company laying off roughly five percent of its managers. However, it is not yet clear how much of this is attributable to artificial intelligence.
