Bank of America Adds 1,000 Contractors to Clean Up Vulnerabilities Exposed by Anthropic's Mythos

01What Happened

On April 7, 2026, Anthropic announced a dedicated security AI agent called "Claude Mythos Preview" along with an industry collaboration program built around it, "Project Glasswing." According to the official announcement, the 12 launch partners were Amazon Web Services, Anthropic, Apple, Broadcom, Cisco, CrowdStrike, Google, JPMorganChase, Linux Foundation, Microsoft, NVIDIA, and Palo Alto Networks. Anthropic officially committed to providing participating organizations with up to $100 million in usage credits and $4 million in donations.

The program delivered results quickly. As of the official announcement on June 2, 2026, roughly 50 organizations participating in Glasswing had used Mythos Preview to detect more than 10,000 high- or critical-severity vulnerabilities. A further official update on October 7, 2026 reported that Anthropic's own open-source scanning had found an additional 5,500 verified vulnerabilities between April and October. On the detection side, Mythos is clearly working.

However, detected vulnerabilities are not fixed automatically. In a post-earnings interview on October 14, 2026, the CEO told CNBC that Bank of America had hired 1,000 new outside contractors, in addition to its existing 3,000 in-house staff, to handle the patching work generated by vulnerabilities found via Mythos. Human remediation speed is struggling to keep pace with detection speed.

02Pricing and Scope

Project Glasswing is not a general subscription product; it's an industry collaboration program open only to organizations invited by Anthropic. At launch, Anthropic stated it would provide participating organizations with up to $100 million in usage credits and $4 million in donations, but no pricing page for individual companies to purchase Mythos Preview on its own has been found.

What Bank of America actually paid for, meanwhile, was not usage fees for Mythos itself but the labor cost of fixing the vulnerabilities Mythos detected. The CEO said the company booked several hundred million dollars in additional costs in the third quarter of 2026, covering software remediation and AML (anti-money laundering) response. The real scale of investment is determined by downstream costs that never appear on the AI tool's price list.

By contrast, Bank of America also said that 130 internal AI projects are expected to deliver roughly $7 billion in cost savings next year (the original figure may be $700 million; we are still verifying the reporting's exact wording — unconfirmed, but quoted as stated in the CNBC article). The fact that this large savings figure and the heavy remediation cost appear in the same earnings commentary is what makes this story worth watching. This kind of 'projected savings' number can easily circulate internally without a clear basis.Common reasons savings estimates get sent back by leadership

is worth reviewing first to avoid repeating the same mistake.

03Where This Matters in Practice

AI-driven vulnerability detection is likely to affect three departments: finance, IT, and internal audit. For IT, prioritizing detected vulnerabilities and assigning remediation owners becomes a new workload. When more than 10,000 detections accumulate over a few months, it's necessary to estimate in advance whether existing staff can handle the volume.

For finance, outsourcing fees and contractor labor costs for remediation work may show up as unbudgeted spending. In Bank of America's case, this cost was described together with software remediation and AML response as 'several hundred million dollars,' with no public breakdown by category. At the budgeting stage, it's necessary to set aside a separate line for remediation costs after adopting an AI security tool. When using AI agents in finance functions, there are control-related questions to work through before accuracy, and the same thinking applies to security detection work like this.

For internal audit, there's a need for a system that records the lead time from detection to remediation completion. This is speculative, but regulators and auditors may ask not just about detection counts but also about remediation completion rates. If decisions keep relying on individual judgment and experience, the same structural problem seen when handover documents meant to reduce reliance on specific staff end up unused

could show up in vulnerability response work as well.

04Controls and Data Handling to Verify

Before adopting an AI security agent, it's necessary to confirm four points: whether detection results are used for training, where they are stored, who has access, and how remediation is documented. Since detected vulnerability information is highly sensitive, confirming in the contract terms that it won't be used externally as training data is a baseline requirement.

Next, it's necessary to sort out where detection results and patch records are stored and who can view them. If there's no record of who decided remediation priorities and who approved them, accountability during audits becomes impossible to demonstrate. Design needs to capture not just detection logs but also the remediation decision-making process. This kind of record-keeping overlaps considerably with conditions essential to operator-led AX, and isn't unique to security.

Finally, when increasing the number of outside contractors, it's necessary to confirm the access-provisioning procedures under existing information security policy. When adding about 1,000 people in a short period, as Bank of America did, there's a risk that access management falls behind.

05What to Do Next

If you're evaluating an AI security tool this week, the next step is to estimate your remediation capacity first. Rather than just projecting detection volume, you need a single document that lays out both the staffing and cost required for remediation to inform the decision. This approach echoes the design philosophy for embedding generative AI into internal workflows

: rather than adopting a standalone tool, you need to redesign the entire process from detection through remediation completion.

Concretely, you can start by taking stock of your current state using the steps below.

You are the head of the information security department. Under the following conditions, draft an outline for a readiness assessment report to complete before adopting an AI security tool.

Assumptions:
- Current number of in-house security staff: [number]
- Average monthly vulnerability detections over the past 6 months: [number]
- Average lead time for vulnerability remediation over the past 6 months: [number] days
- Expected increase in detection volume after AI tool adoption: [multiplier, e.g., 3x]

Please produce:
1. Current handling capacity (maximum cases processable per month)
2. The projected gap versus expected post-adoption detection volume
3. A rough estimate of the additional staff or outsourcing scale needed to close the gap
4. The basis for estimating additional costs (calculate labor cost using a unit rate of [rate] per day)
5. A proposed structure for a one-page summary for leadership reporting