Bank of America: Mythos found too many flaws

"Not in the headcount but in consultants"

On October 14, Brian Moynihan walked analysts through Bank of America's quarterly results. The CEO went through the rise in expenses line by line, then dropped a sentence that says more than his figures do. Mythos remediation costs should run down, he said, because the bank had added 1,000 extra staff to work on it, "not in the headcount but in consultants" (from the call transcript).

Mythos is Anthropic's model, the one that turns up security flaws in bulk in whatever software you point it at. Bank of America reacted like a house where the smoke detectors go off in every room at once: it called for backup. What's worth noticing is where the backup got filed.

What Mythos set off

Quick recap. Anthropic announced Mythos on April 7 and kept access to a closed circle of organizations, on the grounds that the model found too many flaws to put in everyone's hands (we covered it here). In early June, that circle grew to about 200 organizations (our write-up). Anthropic said participants had surfaced more than 10,000 vulnerabilities rated high or critical. Every one of those alerts lands on someone's desk. That person has to verify it, write the fix, test it and ship it without breaking everything else.

After the call, Moynihan gave CNBC the longer version. The bank put on 1,000 contractors in the second quarter to do the patching work, and they're still there, "on top of the 3,000 people we have in that area." When the most advanced models arrived, he said, plenty of people wondered how to get past that moment quickly. The risk, in his view, is real.

1,000 reinforcements, not 4,000 hires

This is where a number started to swell. The trade site The Decoder headlined "4,000 people" put on fixing vulnerabilities. The math is easy: 1,000 consultants plus 3,000 employees. But those 3,000 are, in Moynihan's own words, the people the bank already has in that area.

Adding them up is like counting the firefighters on duty together with the crews called in for the blaze. The only addition is 1,000 outside people. The body of The Decoder's piece doesn't claim 4,000 were hired either. The headline does the adding.

Two things remain unknown. First, how many flaws the bank has to deal with: it gave no count. Second, how much of this is Mythos specifically. CNBC describes advanced AI models "including Anthropic's Mythos," while Moynihan, talking to analysts, names only Mythos.

The amount you can't read

Then there's the money. Moynihan explained the year-over-year rise in expenses to analysts: about $1.2 billion before penalties. Roughly $450 million came from wealth management incentives, roughly $300 million from the markets business, which leaves around $400 million. Within that remainder, "a couple of hundred million plus" went in the third quarter to two things: anti-money-laundering remediation and Mythos remediation. That's his phrasing, spoken and approximate, not an accounting figure.

There's no breakdown. And earlier in the same call, asked about regulatory orders, Moynihan used nearly the same wording, a couple hundred million dollars plus this quarter, for anti-money-laundering remediation alone. So one amount is used twice: once for one workstream, once for two. It's a receipt with two purchases rung up on the same line. You can't back out Mythos's share.

The written documents don't help either. The word Mythos appears in neither the earnings release nor the investor presentation. The release does cite AI as an asset, with more than 200,000 employees using AI tools and more than 300 approved use cases. Mythos's cost exists only out loud, as an approximate phrase shared with another project.

Don't confuse that sum with the penalties, either. On October 13, the Office of the Comptroller of the Currency (OCC) and the Treasury's financial crimes unit (FinCEN) announced orders aimed at the bank's anti-money-laundering and sanctions controls. Bank of America booked a $1.2 billion charge for the civil penalties, the same amount as the rise in expenses, with no link between the two. That line has nothing to do with Mythos. It does explain why quarterly net income fell to $6.9 billion, from $8.3 billion a year earlier.

Two columns that never meet

In the same answer, Moynihan gave another number: headcount down by about 3,000 over the year, or 1.5%, with managers down about 5%. AI, he says, is already paying off. The bank counts around 130 projects in place and expects $250 million to $300 million in benefits this year and $700 million next year. Its development teams are said to be 10% more efficient.

The bank doesn't say how much of the headcount drop comes from AI. It doesn't connect the two columns either, which makes sense: the drop is counted in headcount, and the thousand consultants aren't, by design. This 3,000 is also a different number from the 3,000 people already working on security. One is a fall in staff over a year, the other is an existing team. A restaurant can shrink its kitchen brigade and hire a caterer for one big banquet. Payroll goes down, and the banquet bill lands somewhere else.

Nothing is hidden here. Moynihan said it plainly, in a single answer. But a skimming reader keeps the 3,000 fewer jobs on one side and never sees, on the other, the 1,000 people brought in to fix what the AI found.

A peak, according to the bank

Moynihan spoke to CNBC on a day when the bank's stock slid as much as 8% during the session, according to the network. He framed the spending as temporary: once you patch, there's less to patch, and the pipeline moves through. It's the logic of a backlog being cleared, the big stock first and the steady flow after. The next earnings reports will show whether the curve follows, provided the bank someday separates Mythos from anti-money-laundering.

In April, Mozilla wrote that Mythos had found no flaw in Firefox beyond the reach of an elite human researcher (we covered that here). Six months later, one of America's biggest banks is telling the other half of the story. The machine finds things fast. Fixing them still takes humans, and Bank of America brought in a thousand.