AI Found the Bugs, Humans Had to Fix Them: Inside Bank of America's 1,000-Contractor Scramble

The rapid evolution of frontier artificial intelligence models has introduced a fascinating paradox to enterprise technology: while advanced AI can autonomously uncover critical software flaws at an unprecedented scale, fixing those vulnerabilities still demands a massive, old-fashioned injection of human labor.

A striking example of this reality emerged when Bank of America CEO Brian Moynihan disclosed that the banking giant brought in 1,000 external contractors during the second quarter. Their mission? To patch extensive software vulnerabilities exposed by advanced AI models, most notably Anthropic's Mythos.

The Catalyst: Project Glasswing and Anthropic's Mythos

Back in April, Anthropic made its powerful Anthropic Mythos model available to a select cohort of corporations, major financial institutions, and government agencies under an initiative known as Project Glasswing. The core objective was proactive: allow frontier AI systems to scan complex enterprise infrastructures and identify security gaps before malicious actors could exploit them.

However, the sheer capability of Mythos opened a Pandora's box of code vulnerabilities. JPMorgan Chase CEO Jamie Dimon noted that cybersecurity risks increased tenfold following the deployment of these advanced frontier models. When an AI system capable of reasoning through millions of lines of legacy code is unleashed, it uncovers weaknesses faster than any traditional internal security team can process.

The Hidden Financial and Labor Toll

The operational fallout at Bank of America highlights the heavy hidden costs associated with modern AI software vulnerabilities. To manage the influx of flagged issues, the 1,000 external contractors had to be deployed to work side-by-side with approximately 3,000 internal bank staff dedicated to software maintenance and security.

The financial impact was substantial. Bank of America reported that code remediation expenses—alongside anti-money laundering compliance—accounted for a 'couple hundred million plus' expense category in the third quarter. Industry analysts view this massive human intervention as proof that autonomous AI security vulnerability scanners create unprecedented remediation workloads. Current enterprise software architectures simply struggle to handle automatic patching without intense human oversight.

Community Reactions: The Spaghetti Code Dilemma and Skepticism

The tech and developer communities on platforms like Reddit did not hesitate to dissect the news. Many users expressed shock and deep skepticism regarding the decision to introduce 1,000 third-party contractors into sensitive banking codebases. Concerns were raised over whether onboarding so many outside entities could inadvertently introduce new security flaws or worsen existing 'spaghetti code' issues.

Others traded dark jokes about an endless cycle of automation: a loop where AI models find errors, contractors patch them, and subsequent AI iterations immediately find fresh mistakes, mocking the illusion of a self-sustaining tech ecosystem.

Frequently Asked Questions

How many specific vulnerabilities or lines of code did Mythos actually uncover?

While precise line-by-line metrics remain confidential under corporate and vendor agreements, the sheer scale is reflected in the multi-million dollar remediation budgets and the necessity of deploying 1,000 external contractors to handle the backlog alongside internal teams.

How does BofA vet the security of external contractors with deep system access?

Given that these 1,000 contractors require extensive access to proprietary banking systems, financial institutions rely on rigorous background checks, strict security clearances, isolated sandbox environments, and continuous code-quality monitoring to safeguard sensitive infrastructure.

Conclusion and Strategic Takeaways

Bank of America's recent scramble serves as a powerful cautionary tale for enterprise cybersecurity risk management. As frontier models become more pervasive, organizations can no longer rely on superficial code assessments.

For enterprise software engineers, IT executives, and fintech security professionals, the lesson is clear: evaluate your current internal codebases for vulnerability blind spots right now. Build robust automated testing strategies and strengthen your remediation pipelines before autonomous security agents expose vulnerabilities on a massive scale.