Bank of America's Mythos patch bill is a new line item

Is an AI model that finds your bugs a productivity tool or a bill? For Bank of America, the answer this quarter was both, and the second one arrived first.

Here is what we know. CEO Brian Moynihan told CNBC that the bank put on 1,000 contractors in the second quarter to patch software flaws exposed by advanced models, including Anthropic's Mythos. The Register also reported the extra hiring. The contractors remain on the job, on top of the roughly 3,000 people already working in that area. The bank spent a "couple hundred million plus" in the third quarter on software remediation and anti-money laundering compliance issues combined. Its shares slumped as much as 8% that day.

Moynihan's message to investors was that this is temporary: "Once you patch, you don't have to patch as much. … The pipeline moves through." The bank expects remediation costs to decline over time.

The "one-off" framing deserves skepticism

We hope Moynihan is right, but we wouldn't underwrite it yet. A backlog of old flaws does eventually clear. The thing that found them does not go away. CNBC notes that Mythos was released in April to a small group of banks, tech firms and government agencies, and that models like it can uncover and exploit decades-old software flaws. If the tools keep improving, and others get comparable ones, the discovery rate becomes a permanent feature of owning large amounts of code.

That is our reading, not something Moynihan or CNBC said. But notice the logic in Moynihan's own words: "We've got to stay ahead of them." Staying ahead is not a project with an end date. It sounds like a standing function, closer to rent than to renovation.

Also notice that the 1,000 contractors are still there months later. Temporary staffing that outlives a quarter is how recurring costs usually start.

The line is blurry, and that is the real investor problem

The reported figure lumps remediation together with anti-money laundering compliance work. We can't tell how much of the "couple hundred million plus" is Mythos-related. That matters, because a cost you can't isolate is a cost you can't forecast, and a manager who can't be asked "how much next year?" has an easy time saying it will fall.

CNBC describes these as some of the first comments by a major U.S. corporation specifying manpower and dollars for this kind of work. That makes Bank of America a useful early data point, and also a reminder that peers have said little. Silence is not the same as no spending. We'd be surprised if other large banks with sprawling legacy code and many vendors faced a radically different problem.

Who budgets for it is the question to ask

Moynihan also pointed out an awkward dependency: the people doing the software development are the people trying to sell banks the services. The bank is patching its own code and vendor code, which means part of the bill may eventually be negotiated with suppliers who also want to sell the fix.

Meanwhile the savings story is real but separate. The bank has about 130 internal AI projects, with savings expected to rise from $300 million this year to $700 million in 2027, and head count fell by about 3,400 in the past year. CNBC says it's unclear how much of that is due to AI. The tidy version of the narrative is that AI savings pay for AI defense. We'd treat that as a hypothesis. A bank could easily be booking productivity gains in one department while defense costs sit in technology, risk or compliance with no one owning the net number.

So what should a shareholder do with this? Not panic, and not take the "temporary" label on trust. On earnings calls, ask three plain questions: how much of remediation spend is tied to AI-discovered flaws, what headcount is expected a year from now, and which executive owns the combined AI savings and AI defense figure. This is analysis, not investment advice, and one quarter doesn't settle anything.

Our verdict: the 1,000 contractors matter less as a number than as a signal. AI security has moved from a risk-committee topic to a budget line, and the banks that can show who owns it will deserve more trust than the ones that call it a one-off.