Bank of America just admitted it threw a couple hundred million dollars and thousands of people at a problem most of us didn’t even know existed. And the culprit? An AI model called Mythos from Anthropic that apparently got so good at finding software vulnerabilities that one of the world’s biggest banks had to essentially go into emergency mode.

When Your Code Becomes an Open Book

Here’s what happened. Earlier this year, these “frontier-type models” – and specifically Anthropic’s Mythos – got good enough at analyzing code that they could spot security holes everywhere. Not just theoretical vulnerabilities. Real ones. The kind that make a bank CEO lose sleep.

Brian Moynihan, BofA’s CEO, said on Wednesday that the bank hired 1,000 external contractors just to help patch everything. That’s on top of the 3,000 people they already had working on this stuff. Think about that for a second. A thousand contractors. Still there today, months later, just fixing code because an AI got too smart.

And it wasn’t just their own code, either. Moynihan said they had to go through “a wide spectrum of its internal and vendor code.” Which means all those third-party systems banks rely on? Also vulnerable. Also need fixing. The blast radius here is massive.

The “Couple Hundred Million Plus” Problem

I love how casually Moynihan dropped the price tag. “A couple hundred million plus” spent in Q3 alone on software remediation. Plus! That’s executive speak for “definitely more than $200 million but I’m not giving you the exact number because it’s embarrassing.”

This isn’t some theoretical exercise or proactive security upgrade. Moynihan literally said they “rushed to bolster” their systems and had to figure out “how do we get through this quickly?” That’s crisis language. That’s “we found out our house has structural problems and we need to fix it before it collapses” language.

What Makes Mythos Different?

Look, AI models have been able to analyze code for years now. But there’s a difference between spotting a syntax error and systematically identifying exploitable vulnerabilities across millions of lines of production code. Mythos apparently crossed that threshold.

The scary part? Moynihan called this “real risk.” Not hypothetical. Not future tense. Real. Present tense. Happening now. And if Bank of America – with all its resources, all its security infrastructure, all its regulatory oversight – had to scramble like this, what does that say about everyone else?

“That risk is real risk, and that’s why when the frontier-type models came out… A lot of us sat down and said, ‘How do we figure out how to get through this quickly?'”

The Uncomfortable Truth Nobody’s Saying

Here’s the thing that’s kind of driving me nuts about this whole situation. We’ve been building software for decades with vulnerabilities baked in, and we basically got away with it because finding those vulnerabilities required human expertise, time, and effort. It was expensive and slow, which weirdly acted as a sort of security through obscurity.

But now? Now you can apparently point an AI at a codebase and it’ll just… tell you where all the problems are. Which is great if you’re the good guys trying to patch things. Absolutely terrifying if you’re not.

And the timeline here is bonkers. Moynihan said they brought on those 1,000 contractors in Q2 – so somewhere between April and June of this year. They’re still there in October. That’s not a sprint, that’s a marathon of technical debt coming due all at once.

What This Actually Means

I think we’re watching the first major domino fall in what’s gonna be a much bigger trend. If Mythos can expose vulnerabilities this effectively, every other frontier model is probably close behind – or already there. Which means every company with software (so, basically every company) is sitting on the same problem Bank of America just spent hundreds of millions to address. The AI Gold Rush That Doesn't Add Up is starting to look less like hype and more like a reckoning nobody's ready for.

The other shoe that hasn’t dropped yet? The bad actors already have access to these models too. Maybe not Mythos specifically, but the technology exists now. You can’t un-invent it. So there’s probably a race happening right now between companies patching their systems and attackers finding vulnerabilities before the patches go live.

What I keep coming back to is this: Moynihan said “a lot of us” sat down to figure this out. Meaning this wasn’t just Bank of America’s problem. Other CEOs, other major institutions, they’re all dealing with this. We’re just hearing about BofA because Moynihan actually said it out loud. How many others are quietly throwing money and people at the same problem, hoping nobody notices? The Great AI Bet: Why Banks Are Already Bailing Out might explain why this meeting happened behind closed doors.

Not gonna lie, that’s the part that keeps me up at night.