Brian Moynihan had already walked analysts through the quarter. Then he volunteered a cost that does not have a line of its own in the results.
Speaking to CNBC on October 14 after Bank of America reported third-quarter earnings, the chief executive said vulnerabilities in the bank’s internal code and in software it buys from suppliers, surfaced by advanced artificial intelligence models, amount to “real risk.” He said the bank added 1,000 outside contractors during the second quarter to work on patches, on top of a 3,000-person team already doing the same work. Those contractors are still on the job.
The remark was specific in a way that bank cyber disclosures usually are not. Risk factors in annual filings describe threats in general terms. A headcount is a number shareholders can compare with the next quarter, and by that measure the bank put roughly a third more people on remediation than it had planned.
The vulnerabilities at issue were surfaced by Mythos, a model from Anthropic, according to the account he gave. The software in question was not written by an adversary. It was the bank’s own code and the code of its vendors, read at speed by a system that does not get tired or take weekends.
That is the shift that security teams have been describing for the past two years. Models trained on code can scan repositories, trace data flows and spot classes of defects that human reviewers miss, including unsafe input handling, misconfigured access and dependencies with known flaws. Discovery has become cheap and fast, and it scales with the size of a codebase rather than with the size of the security budget.
Fixing has not changed at the same rate. Every finding has to be read, judged, prioritized, patched, tested and released, and each of those steps involves people who are already busy. At a bank, the sequence is longer still, because changes to systems that move money run through change-control procedures, and examiners expect a documented record of how each issue was resolved.
The third-party half of the problem is harder to schedule. A bank can set its own release calendar for its own applications, but a supplier’s code moves when the supplier decides it moves. Supervisors hold the bank accountable anyway, under rules that treat the institution as responsible for the risk its vendors introduce. Regulators on both sides of the Atlantic have treated third-party technology risk as a supervisory priority for years, and the review that produced the bank’s number sits inside that framework.
Contract labor is the flexible answer to a workload whose size is not yet known. Permanent hiring in information security takes months, requires approvals, and is difficult to reverse when the queue shortens. Contractors start quickly, cost more per hour, and can be released. That the bank kept them on into the third quarter suggests the queue did not clear as fast as planned.
Volume is the other problem. Automated reviews produce findings faster than teams can adjudicate them, and a large share of what a scanner reports turns out to be low severity or not exploitable in the way the bank uses the software. The industry’s response has been to rank findings by how reachable they are from outside the network, which reduces the queue without making it small.
For the bank’s cost base, the effect is a remediation budget that behaves like a permanent expense rather than a project. Banks have spent a decade building cyber organizations around fraud, payments and customer data, and those programs are now large enough to be discussed in general terms on earnings calls. AI-driven discovery adds a workload that is easy to describe and hard to finish, because the codebase keeps changing.
Banks are also learning to use the same tools on the other side of the trade. Security vendors now sell reviews that lean on models to read code changes before they ship, which shifts part of the work from remediation to prevention. Whether that reduces the queue or simply moves it earlier in the development cycle is the question budget holders are asking.
Supervisors have not settled on how this should be reported either. Institutions file incident notices when something goes wrong, and regulators inspect change-control records, but there is no standard disclosure for a backlog of known vulnerabilities. That gap is why a chief executive mentioning a contractor count reads as unusual rather than routine.
What the disclosure does not include is how many findings remain open, how many were severe, and whether the contractor count falls in the fourth quarter. Mr. Moynihan described the risk as real without putting a limit on it, which is the standard posture of a chief executive discussing a problem he cannot yet size.
There is a broader point buried in the headcount. The same models that make code easier to write also make it easier to examine, and companies that adopt one side of that trade are discovering the other side. For a bank, the bill arrives as patch cycles, contractor invoices and examiners asking why a known flaw was still open.
Shareholders will see the number again if it grows. The bank’s next quarterly report is due in January, and the contractor line, unlike the code, is something the company can describe in a sentence.
