Bank of America is no longer deciding how many engineers to add to its security remediation pipeline. A thousand contractors are now in the building, working on the same class of software flaws that advanced AI models surfaced faster than in-house teams could chase down.
The move came as the bank reported that advanced models, including Anthropic's Mythos, had identified vulnerabilities across its systems at a pace that outstripped the existing remediation staff. Rather than treating the findings as a one-time audit, the bank treated them as a steady stream of work, and staffed accordingly.
The story is less about the flaws themselves than about the labor math that now follows them. When an AI model can find the same category of defect in hours that a security team previously found in quarters, the remediation bottleneck shifts from discovery to fix capacity. Discovery is getting cheaper; fixing is not. The result is a payroll line, not a software release.
For other large financial institutions the pattern is visible in the same reports: Citi and peers have restricted agent access to accounts, not because agents moved money, but because the fear that a chatbot could shift deposits is now a policy constraint. The risk is not being materialized. It is being priced, scoped, and staffed against.
The second-order effect is a split between the cost of finding problems and the cost of fixing them. Labs are racing to produce more vulnerabilities, or at least more visible ones. Banks are racing to staff the fix. The gap between the two is where the new budget lives.
Image source: i.ibb.co