ArpSentry: Bank of America, Mythos and AI-found flaws

Key points.

Bank of America added 1,000 contractors in the second quarter of 2026 to patch flaws found by AI models, on top of 3,000 people it already had in that area. Its CEO named Mythos on the earnings call; CNBC reports the flaws came from several advanced models, Mythos among them.
The bank gave one figure, a "couple hundred million plus" in the third quarter, for two things together: fixing these flaws and fixing its anti-money laundering controls. It expects the software cost to fall.
Some reports say one scan at the bank flagged more than 23,000 issues. We found no statement by the bank with that number. It matches Anthropic's May 2026 count for open-source projects: 23,019 potential vulnerabilities.
Anthropic's own figures show the bottleneck: of 6,202 findings its model rated high or critical in open-source code, 75 had been patched by 22 May 2026.
Regulators in the US, the UK and the EU have told banks to patch faster. For a small company the change arrives through its software suppliers: more updates, and less time between a fix being published and attackers using the flaw.

What Bank of America said.

Bank of America published its third-quarter results on 14 October 2026. On the earnings call earlier that day, chief executive Brian Moynihan explained part of the quarter's rise in costs: "a couple hundred million plus in the third quarter were two things, remediation for the AML and remediation for the Mythos implementation." AML is anti-money laundering. That week the bank had agreed a $1.21 billion settlement with the US Treasury's Financial Crimes Enforcement Network and a $750 million penalty from the Office of the Comptroller of the Currency, so a large part of the sum may have nothing to do with AI. He did not split it.

He added: "we expect that the Mythos remediation costs run down because we added 1,000 extra staff to work on that, not in the headcount but in consultants." These quotations come from a published transcript of the call.

In an interview with CNBC after the call, he described the decision. "That risk is real risk, and that's why when the frontier-type models came out. … A lot of us sat down and said, 'How do we figure out how to get through this quickly?" And: "We put on 1,000 contractors to help us do the patching work in the second quarter, and those people remain here today, helping us, on top of the 3,000 people we have in that area." According to CNBC, the work covered a wide spectrum of the bank's internal and vendor code.

He presented the cost as temporary: "Once you patch, you don't have to patch as much. … The pipeline moves through." He also pointed at software suppliers: "We've got to stay ahead of them, and we've got to be mindful that the people doing the software development are the people trying to sell us the services."

Mythos alone, or several models.

Coverage differs on what found the flaws. CNBC, which interviewed Moynihan, writes that the contractors patch vulnerabilities "exposed by advanced artificial intelligence models including Anthropic's Mythos". ITPro writes "Anthropic's Mythos and other AI security models". The Register attributes everything to one model: the contractors help "patch all the vulnerabilities discovered by Anthropic's Mythos model".

Moynihan's own words point both ways. On the call he spoke of "the Mythos implementation"; to CNBC he spoke of "the frontier-type models", plural. We found no source quoting him saying that Mythos was one of several models; that is CNBC's summary. Our reading: Mythos was the model he named, and the bank has not said whether other models found part of the flaws, or how many.

The cost is reported differently too: "couple hundred million plus" at CNBC and in the transcript, "a couple of hundred million plus" at The Register. TechRadar wrote that the bank spent "north of a $100 million dollars" to fix the bugs found by Mythos; the bank gave no Mythos-only figure. In a separate answer on the same call, Moynihan used "a couple hundred million dollars plus" for the anti-money laundering work alone, which leaves the split unclear.

Where the 23,000 figure comes from.

Several articles about Bank of America say that "one scan alone flagged more than 23,000 potential issues", most of them rated low to moderate. The earliest we found is Crypto Briefing, published minutes after CNBC. It gives no source and does not say whose systems were scanned. CNBC, The Register, ITPro and the call transcript do not contain the number.

The number does appear in a primary source, about different software. On 22 May 2026, Anthropic reported that Mythos Preview had scanned more than 1,000 open-source projects and found what it estimates are 6,202 high- or critical-severity vulnerabilities "out of 23,019 in total, including those it estimates as medium- or low-severity". Most were therefore medium or low, as the bank reports say. We think the bank figure is most likely a mix-up with this count, but we cannot prove it, and we do not attribute it to Bank of America.

Anthropic's count is useful for another reason: it shows what happens to findings after a scan.

From finding to fix.Anthropic's scan of more than 1,000 open-source projects, as reported on 22 May 2026. Every stage after the scan needs people: to reproduce the issue, rate it, write a report and design a patch.

Potential vulnerabilities flagged23,019
Rated high or critical by the model6,202
Of those, checked by independent security firms1,752
Confirmed as high or critical1,094
High or critical, reported to maintainers530
Patched75

The stages overlap rather than form one chain: some reports went to maintainers without independent checking, and 530 is Anthropic's estimate.

What Claude Mythos Preview and Project Glasswing are.

Anthropic announced Claude Mythos Preview on 7 April 2026, together with Project Glasswing, a group of companies using the model to find and fix flaws in widely used software. Anthropic called it "a general-purpose, unreleased frontier model" and wrote that AI models "can surpass all but the most skilled humans at finding and exploiting software vulnerabilities".

Its published examples include a 27-year-old flaw in OpenBSD that let an attacker crash a machine just by connecting to it, a 16-year-old flaw in FFmpeg in a line of code that automated testing tools had hit five million times, and several Linux kernel flaws chained together to take full control of a machine. All three have been patched.

Access is restricted. The launch partners were Amazon Web Services, Anthropic, Apple, Broadcom, Cisco, CrowdStrike, Google, JPMorganChase, the Linux Foundation, Microsoft, NVIDIA and Palo Alto Networks, plus "over 40 additional organizations that build or maintain critical software infrastructure". Anthropic wrote: "We do not plan to make Claude Mythos Preview generally available", until it has safeguards that "detect and block the model's most dangerous outputs". Bank of America is not on the launch list. CNBC describes Mythos as released "to a small group of banks, technology firms and government agencies in April"; we did not find how the bank obtained access.

Six months, in order.

7 April 2026Mythos Preview and Project GlasswingAnthropic announces the model and limits access to 12 launch partners and over 40 other organisations.
Same weekBank chiefs meet Powell and BessentThe Fed chair and the US Treasury Secretary discuss the cyber risks of Mythos with bank CEOs, Moynihan among them.
April to June 20261,000 contractors at Bank of AmericaThe bank adds them in the second quarter to patch flaws found by AI models.
22 May 2026Anthropic's first updatePartners have found more than ten thousand high- or critical-severity flaws. In open source: 23,019 flagged, 75 serious ones patched.
7 July 2026ECB letter to eurozone banksBanks are asked for an action plan on AI-enabled cyber threats by 31 October.
14 October 2026Third-quarter resultsMoynihan describes the contractors and the combined remediation cost.

What a vulnerability scan by an AI model is.

A vulnerability is a mistake in software that lets someone do what they should not: read data, take over an account, run their own code. Traditional scanners look for known patterns, or feed a program huge amounts of random input to see what breaks. They are fast, but they miss mistakes that only make sense once you understand what the code is meant to do.

An AI model scans more like a human reviewer. It reads the code, forms a guess about where it could go wrong, tests the guess, and writes up what it found. Anthropic says Mythos Preview found nearly all of its published vulnerabilities "entirely autonomously, without any human steering", in many cases building a working attack to prove the flaw is real. What used to take an expert days per bug can now run across thousands of files in parallel.

The output is a list of findings, and a finding is not yet a confirmed vulnerability. Some are false alarms, some are duplicates, and some are real but harmless in practice.

Triage and severity.

Triage is the sorting that follows a scan: is the finding real, how bad is it, who owns the code, and what gets fixed first. Severity is the "how bad" part. The common scale, CVSS, gives a score from 0 to 10 and maps it to five ratings: None (0.0), Low (0.1 to 3.9), Medium (4.0 to 6.9), High (7.0 to 8.9) and Critical (9.0 to 10.0).

Severity is not the same as urgency. A critical flaw in a system nobody can reach from the internet can wait longer than a high one on the login page of a public website. That is why triage needs people who know the systems, and why it takes time.

Models help here too. In 198 reports that Anthropic had checked by hand, outside experts agreed exactly with the model's severity rating in 89% of cases, and within one level in 98%. Even so, Anthropic sends its most severe findings to human triagers before telling a software maintainer.

Why finding is cheap and fixing is not.

Anthropic put the change in two sentences in May: "Progress on software security used to be limited by how quickly we could find new vulnerabilities. Now it's limited by how quickly we can verify, disclose, and patch the large numbers of vulnerabilities found by AI."

Each confirmed flaw still needs someone to understand the code, write a fix, test that nothing else breaks and roll it out. For software bought from a supplier, only the supplier can fix it. Anthropic reports that a high- or critical-severity bug found by Mythos Preview takes two weeks to patch on average, and that some open-source maintainers asked it to slow down its reports because they needed more time to design patches.

A large bank can add people. Bank of America did, and expects the queue to shrink once the first wave is through.

One scan, a fixed team.A scan adds thousands of findings at once; fixing them depends on people. Bank of America added 1,000 contractors to the 3,000 people already in that area.

The shape of the queue is an illustration, not the bank's data.

What changes for attackers and defenders.

The same capability serves both sides, and for now defenders have it first: access to Mythos Preview is limited to selected organisations. But Anthropic also expects that "models as capable as Mythos Preview will soon be developed by many different AI companies".

The bigger change is the time after a fix is published. A security update shows where the flaw was, so attackers can study it and target everyone who has not installed it. Anthropic calls these N-days and writes that "the patch itself is a roadmap to the bug". It reports that Mythos Preview wrote working attacks for patched flaws starting from just a public identifier and the code change, work that "has historically taken a skilled researcher days to weeks per bug".

This was already speeding up before Mythos. Google's Mandiant measures time-to-exploit, the average time taken to exploit a vulnerability before or after a patch is released. It fell from 63 days in 2018 and 2019 to five days in 2023 (47 days if outliers are kept). In its 2026 report Mandiant estimates minus seven days: exploitation routinely starts before a patch exists. Verizon's 2026 breach report finds that exploiting vulnerabilities is now the most common way into a breach, at 31%.

Not everyone sees a new kind of threat. Mozilla, which fixed 271 vulnerabilities in Firefox 150 while testing Mythos Preview, was quoted by The Register as saying it had not seen bugs "that couldn't have been found by an elite human researcher". What changes is scale and cost.

How regulators and other banks reacted.

In the week Mythos was announced, Federal Reserve chair Jerome Powell and Treasury Secretary Scott Bessent met the heads of major US banks to discuss the cyber risks it raised, CNBC confirmed. Bloomberg reported that Moynihan was among them.

European and British authorities wrote about the class of models rather than Mythos by name. The UK's National Cyber Security Centre told organisations on 1 May to prepare for a "vulnerability patch wave" and to adopt a policy to "update by default", advice it gave to "all organisations, irrespective of size". On 15 May the Bank of England, the FCA and HM Treasury said frontier models' cyber capabilities "are already exceeding what a skilled practitioner could achieve", and that "Firms that have underinvested in core cyber security fundamentals are likely to become progressively more exposed."

The European Systemic Risk Board warned on 25 June that writing a working exploit, once a matter of "days or weeks", can now be done "in a matter of minutes or hours", a "collapse of defensive time buffers". On 7 July the ECB asked the large eurozone banks it supervises directly for an action plan by 31 October 2026, calling this "a long-term shift in the threat landscape rather than a temporary phenomenon or a risk tied to any single tool". First on its list: "accelerate vulnerability and patch management at scale".

Among other banks, JPMorganChase's Jamie Dimon called Mythos a "very heightened risk" in May, according to American Banker, and said his bank could probably handle its own applications' vulnerabilities in "a year or so". He added: "the banks in total are rather well protected. That doesn't mean everything that banks rely on is that well protected."

What it means for a company of up to 100 people.

A company of 30 people will not run Mythos and does not need to. Its exposure comes through the software it buys and the devices it connects to the internet: the accounting and invoicing system, the website and its plugins, the firewall or VPN box, the email suite, the remote access tool an IT supplier uses.

Three things follow from the bank's story. First, more security updates are coming from those suppliers; Microsoft, as quoted by Anthropic, expects its number of patches to "continue trending larger for some time". Second, what matters is no longer whether you patch, but how many days pass between a fix being published and it being installed. That interval is the patch gap. Third, software whose supplier has stopped issuing updates carries more risk than before, because flaws in it will be found and will not be fixed.

The patch gap.Exposure starts when the supplier publishes a fix, because the fix also shows attackers where the flaw is, and ends when the fix is installed. The yellow bar is that window.

43 days is Verizon's 2025 median for fully fixing vulnerabilities on CISA's list of known exploited flaws. The other two values are examples.

Verizon found that only 26% of those known-exploited vulnerabilities were fully fixed by organisations in 2025. Against attackers who need days, a gap measured in weeks is the opening.

The sensible general direction for most small companies is the one the NCSC gives: update by default. Turn on automatic updates wherever the software allows it, know which of your devices and services can be reached from the internet and update those first, and replace software and hardware that no longer receives security fixes.

What to ask your software suppliers.

Moynihan's remark about suppliers and Dimon's about "everything that banks rely on" apply at every size: much of the code you depend on is written by someone else. These questions help you see how a supplier will cope with more findings.

How do you look for vulnerabilities in your product, and has the number of fixes changed this year?
How quickly do you release a fix for a critical vulnerability, and how do you tell customers?
Do security updates install automatically, or does someone on our side have to act?
Until when will the version we use receive security updates?
If you host the product for us, who installs the fixes, and how would we know it was done?

What we could not verify.

The 23,000 figure for Bank of America. We found no statement by the bank containing it; the only matching primary source is Anthropic's count for open-source projects.
Whether models other than Mythos found part of the bank's flaws, and how the bank obtained access to Mythos.
How the "couple hundred million plus" divides between the Mythos work and the anti-money laundering work.
Any severity breakdown of the flaws at Bank of America. The bank has not published one.
The Mozilla quotation, which we read as quoted by The Register, not in Mozilla's own text.

Sources.

Ask about your own systems.

We can look at what your company exposes to the internet and how quickly security updates reach it.