Bank of America Hired 1,000 Contractors to Patch AI-Found Software Flaws

Bank of America hired 1,000 contractors in the second quarter of 2026 to patch software flaws that advanced AI models — including Anthropic’s Mythos — had exposed in the bank’s own code and vendor software. CEO Brian Moynihan told CNBC on October 14 that those contractors were still on site, on top of about 3,000 internal staff already in that work. LinkedIn News surfaced the same hiring-spree headline to inboxes the next day.

This is defensive patching, not a report that customer accounts were breached. The same earnings day, Moynihan also put third-quarter spending on software remediation and anti-money-laundering work together at a “couple hundred million plus.” That combined figure is not a Mythos-only line item: Treasury’s FinCEN $1.2 billion BSA/AML penalty landed October 13.

Snapshot

What Moynihan said

After the bank’s third-quarter results, Moynihan told CNBC’s Leslie Picker that when frontier-type models arrived, executives sat down to work out how to get through the risk quickly.

“That risk is real risk.”

“We put on 1,000 contractors to help us do the patching work in the second quarter, and those people remain here today, helping us, on top of the 3,000 people we have in that area.”

He expects the extra spend to fade: “Once you patch, you don’t have to patch as much. … The pipeline moves through.” He also flagged a vendor bind: the firms writing the software are often the same firms selling the fix.

Business Insider reported he used the phrase “Mythos remediation” on the earnings call. IT Pro put the same contractor count against Anthropic’s Project Glasswing limited access.

On the savings side, Moynihan told analysts the bank has about 130 internal AI projects, with expected savings rising from $300 million in 2026 to $700 million in 2027. Head count fell by about 3,400 over the past year. How much of that cut is AI is unclear. Shares fell as much as 8% on the earnings print.

Why Mythos forced a scramble

Anthropic opened Mythos in April to a small set of banks, technology firms, and government agencies. CNBC and Quartz report U.S. banks then compressed remediation from weeks to days, with findings ranging from several hundred to thousands of flaws — most rated low to moderate. Business Insider notes JPMorgan Chase CEO Jamie Dimon has said cyber risk rose ten-fold after the model’s release.

That matches the pattern we already documented when Mozilla patched 271 Firefox issues found with Mythos Preview: Mozilla Firefox Mythos vulnerabilities. The Five Eyes AI-attack warning and Beazley Q2 agentic-CVE report are the same season — discovery volume up, credentials and BEC still the cheap path in.

A bank can hire 4,000 people to patch and still leave customers exposed to lookalike domains and contractor-onboarding mail. The hiring news itself is bait: “BofA contractor portal,” “Mythos vendor SSO,” “complete your badge.” Type the bank yourself.

What to do

1. This is not a reason to click a “Bank of America security update” or “contractor onboarding” link from email or LinkedIn. Open the app you already have, or type bankofamerica.com yourself.
2. If you bank at BofA, enroll the documented USB security key (FIDO2 / YubiKey-class). SMS remains an alternate path — the key is the Strong path.
3. Treat vendor and contractor mail the same as wire-change mail: a phone number from the message is not a callback you should use.
4. Report suspected bank phishing at IC3 and ReportFraud.ftc.gov.
5. The FinCEN/OCC AML actions are a separate regulatory story. They do not mean your login was stolen.

MFA: YubiKey and Google Authenticator

A hardware key on your Bank of America login does not patch vendor software, and it does not stop a contractor from clicking a lookalike onboarding page. It does cut a lot of the fake-bank sites that will ride this headline. Grades match our MFA directory.

Bank of America documents a consumer FIDO2 USB security key for Online Banking login and higher-value transfers — Strong. It does not advertise Google Authenticator. SMS remains an alternate. Passkeys = No (a hardware key is not a platform passkey).

LinkedIn documents authenticator-app two-step verification and passkeys — Pass, no clear consumer YubiKey path in public help.

Consumer Claude.ai documents email magic-link plus Google or Apple sign-in. Anthropic does not publish a native YubiKey or Google Authenticator enrollment for that login — Fail. Separately, the Cyber Verification Program that gates Mythos-class access requires phishing-resistant MFA (FIDO2 security key, passkey, or PIV) on the customer’s identity provider by December 15, 2026. Authenticator-app codes do not qualify for that program. That is a grant requirement, not a Claude.ai enrollment screen.

Directory: MFA support directory · Category → Banks / Email & Identity / Social & Professional. National scorecard: National banks MFA.

Recommended MFA tools

We may earn a commission if you buy a YubiKey or sign up for Proton Pass through the links above.

Independent cybersecurity audits

We audited the bank, the model vendor, the CNBC source host, the LinkedIn newsletter host, and IC3 on October 15, 2026. 100% is the ideal overall domain-security score. None reach it. Strong MFA docs are a different control plane from email and website hygiene — Bank of America is Strong on the USB key and 53% on the public domain.

Audit links: ic3.gov · linkedin.com · anthropic.com · bankofamerica.com · cnbc.com

The LinkedIn News mail that carried this headline authenticated: ProtonMail recorded SPF pass, DKIM pass, and DMARC pass (p=reject) for linkedin.com / maile.linkedin.com. Authenticated mail is still not a reason to click a “BofA contractor” attachment inside a social network.

Website stack (website-tech)

Passive CMS/TLS probe October 15, 2026 (--deep --fresh --for-news).

Webflow on anthropic.com is vendor-managed for core updates. Review apps, themes, and admin MFA anyway. An undetected bank stack is not a finding that the online-banking app is unpatched.

Email blacklists

Public DoH checks October 15, 2026: bankofamerica.com, anthropic.com, cnbc.com, linkedin.com, and ic3.gov were clear on mail/domain lists we can query. CNBC and LinkedIn showed web/CDN notes (Spamhaus ZEN / SPFBL / SpamRATS) — not counted as mail-reputation hits and not a reason to distrust the CNBC article or the LinkedIn newsletter.

Cybersquat / lookalikes

BEC-profile registered-only scans October 15, 2026 (--max=40).

Eight Bank of America lookalikes already redirect to the real site (including .biz / .info / .io / .net / .org / .us). Others with mail records — including abankofamerica.com, boankofamerica.com, and brankofamerica.com — are still worth treating as untrusted. Anthropic BEC staging: annthropic.com, anthropic.tech, eanthropic.com. LinkedIn: nlinkedin.com, slinkedin.com. CNBC: cnbc.cloud. IC3: ic3.com (same staging host we flag in other News posts).

Continuous monitoring: Cybersquat Domain Monitoring.

CourtListener

RECAP search October 15, 2026 for "Bank of America" AND (Mythos OR "software remediation" OR "AI-exposed") filed after April 1, 2026: 0 hits. Broader Anthropic PBC civil suits (copyright and similar) and generic Bank of America consumer dockets are unrelated to this contractor surge. There is no public federal complaint in that pass that a Mythos finding was exploited against BofA customers.

Related reading

• Mozilla Firefox Mythos vulnerabilities (May 2026)
• Five Eyes AI-driven attack warning
• Beazley Q2 2026 agentic CVE flood
• National banks MFA — SMS vs YubiKey
• Chameleon SEO bank-search phishing
• MFA support directory

Sources: CNBC, Oct 14, 2026 — Hugh Son · Business Insider, Oct 15 · IT Pro, Oct 15 · Quartz, Oct 14 · LinkedIn News newsletter to EmailMeNow (Oct 15; SPF/DKIM/DMARC pass) · Bank of America USB security key · Anthropic CVP security requirements · FinCEN, Oct 13 (AML context only). Independent EmailMeNow audits, website-tech, blacklist, cybersquat, and CourtListener searches October 15, 2026. Domain scores: audit.emailmenow.com only.