Bank of America puts 4,000 people on patching AI-found flaws

Bank of America has assigned about 4,000 people to fixing software vulnerabilities that AI models have uncovered, according to a 15 October 2026 report by The Decoder, which cites CNBC. The Decoder says CEO Brian Moynihan told CNBC that 1,000 outside contractors have worked alongside 3,000 internal employees since the second quarter. The figures below are the outlet's account of those remarks; Bank of America has not published them on a page I can cite.

What was reported

• Headcount: 1,000 contractors plus 3,000 internal employees, working together since the second quarter of 2026.
• Cost: Moynihan said the bank spent a few hundred million dollars in the third quarter on the software work and on anti-money-laundering requirements combined. The Decoder says he did not give a separate figure for patching alone.
• Trend: Moynihan expects patching costs to come down over time, The Decoder reports.

Why the vulnerabilities exist at scale

On 7 April 2026 Anthropic announced Project Glasswing and said its unreleased Claude Mythos Preview model "has already found thousands of high-severity vulnerabilities, including some in every major operating system and web browser". That is Anthropic's own claim about its own model. The Decoder adds that OpenAI followed in May with a cybersecurity programme called Daybreak, and that independent evaluations have since confirmed the stronger capabilities of the new models. I have not checked those evaluations here.

What it leaves out

• How many vulnerabilities Bank of America has to fix, and how many it has fixed. The report gives people, not tickets.
• Which systems are affected, and whether the flaws were found by the bank's own use of AI models or by third parties.
• Cost of patching alone, since the figure mixes in anti-money-laundering work.
• Whether the contractors are doing fixes by hand or using AI coding tools to write patches.

What a team can take from it

The Decoder calls Bank of America one of the first major US companies to disclose how many people it has put on this work. For a team using AI to scan its own code, the lesson is about the queue after the scan. Each finding needs triage, a change, a test and a release. Before you point a model at a large codebase, decide who owns the fixes, how many a week your engineers can ship, and whether a finding that waits is acceptable. Bank of America's answer was 4,000 people; a smaller company needs its own answer, and a budget line to match.