Bank of America hired 1,000 contractors but never priced the Mythos work

Bank of America spent “a couple hundred million dollars plus” on remediation in the third quarter, and both reports of its 14 October results said that money covered software patching plus anti money laundering compliance. Neither noted that Chair and CEO Brian Moynihan used the identical phrase twice on the call. The first time, answering Truist Securities analyst John McDonald about the OCC and FinCEN orders, he applied it to the money laundering remediation on its own.

The second use came later in the transcript, answering Wells Fargo Securities analyst Mike Mayo about AI. There Moynihan said the same “couple of hundred million plus in the third quarter were 2 things: remediation for the AML and remediation for the Mythos implementation.” Which means the bank’s own account puts no separate price on the AI patching, and the share attributable to Anthropic’s Mythos could be small.

The staffing is firmer. CNBC, which ran the interview, quoted Moynihan telling Leslie Picker that the bank put on 1,000 contractors in the second quarter to do the patching work, on top of 3,000 people already in that area. The transcript carries the same figure, and it adds a detail the coverage skipped.

We expect that the Mythos remediation costs run down, because we added 1,000 extra staff to work on that, not in the headcount but in consultants.

Brian Moynihan, Chair and CEO, Bank of America, Q3 2026 earnings call

Because those consultants sit outside reported headcount, the patching bill lands in expenses rather than in staff numbers. Moynihan then walked analysts through where the expense growth went, and that arithmetic is the closest thing on offer to a ceiling on the Mythos line. Total expenses rose $1.2 billion year over year.

Component of the $1.2B expense rise	Amount Moynihan gave
Wealth management incentives on revenue growth	about $450 million
Global Markets, BC&E	about $300 million
Everything else	about $400 million
AML plus Mythos remediation, Q3 only	a couple hundred million plus

Business Insider framed the spending as protecting the bank’s software “from powerful rogue AI agents”. Anthropic’s own account describes something closer to the reverse, because Mythos was handed to organisations to search their own code. Its 6 October post on the Cyber Verification Program says Project Glasswing partners uncovered at least 129,000 verified software vulnerabilities between April and July 2026, and that more than 33,000 of the verified vulnerabilities it counted were rated critical or high severity.

That April start matches CNBC’s reporting that Mythos went to a small group of banks, technology firms and government agencies in April. Mythos 5 itself launched on 9 June as an upgrade to Claude Mythos Preview, with safeguards lifted in some areas rather than added. Glasswing members now move to a Specialized Access tier, which Anthropic says covers organisations authorised to test systems such as interbank transfer infrastructure.

On the other side of the ledger, Moynihan put the bank’s roughly 130 AI projects at $250 million to $300 million of benefit this year, rising to $700 million next year. He was blunt about their individual size, saying “none of them are huge contributors” while the benefits overall run 2x to 3x the expense over time. He also said technology development, at $4 billion and change a year, is 10% more efficient, so next year buys 10% more work for the same cost.

That efficiency shows up in the staff count, though not as cleanly as he put it. Moynihan told analysts headcount was “down by 3,000 or 1.5% year-over-year” with managers down about 5%. The earnings release gives 209,911 staff at 30 September 2026 against 213,384 a year earlier, a fall of 3,473 or 1.6% by our calculation. CNBC’s “about 3,400” was closer to the release than the chief executive’s own round number.

None of this makes the AI cyber pressure on banks imaginary. Regulators have said much the same, and the Bank of England’s Bailey told the G20 that frontier AI leads cyber risks. Agents have reached live systems too, including Australia’s Medicare portal.

What’s missing is still a number. The $1.2 billion regulatory settlement charge is non tax deductible and cost $0.17 a share, and Moynihan said it resolves the penalty in a 2024 cease and desist order. So until the bank splits the AML line from the Mythos line, the cost of hardening a bank against a frontier cyber model stays a phrase rather than a figure. The fourth quarter call is where that split would appear.