New · See every ThinkChat feature in action. Take a look →
ThinkChat
Start free trial

Knowledge IT

AI is finding software bugs faster: what Bank of America’s 1,000 contractors mean for small businesses

IT 6 min read

On 14 October 2026, CNBC reported that Bank of America had brought in 1,000 contractors to help patch software weaknesses exposed by advanced AI models, including Anthropic’s Mythos, citing an interview with the bank’s CEO, Brian Moynihan. If one of the world’s biggest banks needs extra people to keep up, it’s fair to ask what this means for a 10-person business that runs on WhatsApp, a booking app and a few laptops.

The short answer: Anthropic says the cost, effort and expertise needed to find and exploit software flaws “have all dropped dramatically” with the latest AI models. Fixing them still takes people, time and discipline. Here’s what happened and a plain checklist you can use.

What Bank of America actually said

In a CNBC interview after the bank’s third-quarter results, Moynihan said:

> “We put on 1,000 contractors to help us do the patching work in the second quarter, and those people remain here today, helping us, on top of the 3,000 people we have in that area.”

He linked the push to “when the frontier-type models came out.” A few details matter:

  • The work covered the bank’s own code and its vendors’ code. CNBC reported the bank “rushed to bolster a wide spectrum of its internal and vendor code.”
  • The cost isn’t separated out. On the bank’s earnings call the same day, Moynihan told analysts that “a couple of hundred million plus in the third quarter were 2 things: remediation for the AML and remediation for the Mythos implementation.” AML means anti-money-laundering compliance. So that figure covers two kinds of work and is not the price of AI-related patching alone.
  • He expects it to be temporary. “Once you patch, you don’t have to patch as much,” he told CNBC. On the call he said the bank expects “the Mythos remediation costs run down.”
  • He also flagged a vendor tension: “the people doing the software development are the people trying to sell us the services,” he told CNBC.

Bank of America is not among the launch partners Anthropic names for Project Glasswing, and none of the sources we checked says the bank uses Mythos itself. The details on Mythos below come from Anthropic, not from the bank.

What is Mythos?

Claude Mythos Preview is an Anthropic model that the company announced on 7 April 2026 alongside Project Glasswing, a programme that gave a limited group of companies and organisations access to the model for defensive security work. In April, Anthropic said: “We do not plan to make Claude Mythos Preview generally available.” In an update dated 6 October 2026, Anthropic said its expanded Cyber Verification Program, for “qualifying security professionals”, gives each access tier its “most capable models, including Claude Opus 5.5, Claude Sonnet 5.5, Claude Mythos 5.1”. So this is still access you apply for, not a general release.

According to Anthropic, Mythos Preview “has already found thousands of high-severity vulnerabilities, including some in every major operating system and web browser.” Anthropic’s published examples include a 27-year-old flaw in OpenBSD and a 16-year-old flaw in FFmpeg, which Anthropic says have since been patched. Anthropic also said in April that fewer than 1% of the potential vulnerabilities it had found so far had been fully patched by their maintainers. Its framing is blunt: AI models can now “surpass all but the most skilled humans at finding and exploiting software vulnerabilities.”

That’s the core shift. Anthropic says some of the bugs it found had “survived decades of human review,” and it warns that “it will not be long before such capabilities proliferate.” Defenders can use these tools, but attackers may get similar ones too.

Why this matters if you’re small

You probably don’t write your own banking software. But you do rely on software someone else wrote: your phone, your laptop, your router, your website plugin, your POS, your booking or chat tools. When flaws in that software are found faster, two things can follow:

  1. You may see more security updates, more often. The fix only protects you once it is installed.
  2. The gap between “flaw found” and “flaw exploited” can shrink. Waiting weeks to click “Update” becomes riskier.

Bank of America’s answer was more people. Yours can be a simple routine.

A simple patching checklist for small businesses

These steps draw on published guidance from the UK’s National Cyber Security Centre (Cyber Essentials) and the US Cybersecurity and Infrastructure Security Agency (CISA):

  1. Turn on automatic updates for phones, laptops, browsers and apps wherever you can. Both NCSC and CISA recommend this.
  2. Install critical and high-risk security updates within 14 days. That’s the Cyber Essentials requirement for updates the vendor rates “critical” or “high risk” (or with a CVSS v3 score of 7 or above). Sooner is better.
  3. Replace anything that no longer gets updates. Old Windows versions, old phones, an ageing router: unsupported software doesn’t get fixed, so Cyber Essentials says to remove it or cut it off from the internet.
  4. Keep a short list of what you use. Devices, apps, website plugins, and who has admin access. You can’t update what you’ve forgotten about. CISA recommends an up-to-date inventory.
  5. Ask your vendors how they patch. CISA also tells businesses to confirm that vendors keep their own systems updated. For any tool that touches customer data, ask: how fast do you apply security fixes, and how will you tell us about an incident?
  6. Watch the “actively exploited” list. If you have an IT person or provider, ask them to check CISA’s Known Exploited Vulnerabilities catalog, CISA’s public list of vulnerabilities that have been “exploited in the wild”, and fix those first.
  7. Know who to call in Malaysia. CyberSecurity Malaysia’s Cyber999 service (MyCERT) takes incident reports by online form, email (cyber999@cybersecurity.my), or phone (1-300-88-2999 during office hours; +6019-266 5850, 24x7, for emergencies like phishing or data breaches). CyberSecurity Malaysia says hotline calls are monitored during business hours (8:30 AM – 5:30 PM).

What this means for AI customer chat on WhatsApp

If you use any AI or chat tool for customer service, it’s part of your software stack too. Treat it like any other vendor: ask how they handle security updates, what customer data they keep, and what happens if something goes wrong.

At ThinkChat, we think the right AI CS hire answers from information you approved, stays honest when it doesn’t know, and can hand over to a person when it should. We’re not part of Project Glasswing and don’t claim any special Mythos-related protection. The checklist above is worth following whichever tools you use.

Soft next step

If you want to hire a ThinkChat AI CS employee, Talk to Lyia on WhatsApp: +60 11-5515 9318.

Sources

Checked 19 October 2026.

← All articles