Bank of America says it brought in 1,000 contractors during the second quarter to help roughly 3,000 internal staff patch flaws in its own and vendor software after advanced AI systems, including Anthropic’s Mythos, exposed vulnerabilities. CEO Brian Moynihan said the contractors remained on the job as of October 14. The staffing figure is also reflected in discussion around the bank’s third-quarter earnings call.
Anthropic introduced Project Glasswing as a controlled effort to use Mythos-class models to find and fix vulnerabilities before comparable capabilities spread more widely.
One number needs careful handling: Moynihan said a “couple hundred million plus” of third-quarter expense covered both anti-money-laundering remediation and Mythos-related remediation. Bank of America did not publicly break out the AI-patching share, so the full amount should not be described as the cost of Mythos.
A concise overview of Mythos and Project Glasswing provides context for the model’s security-focused deployment.
What the data actually shows
Anthropic’s vulnerability-disclosure dashboard reports 29,439 discovered findings, 6,123 triaged candidates and a 92.7% true-positive rate among externally reviewed candidates in its selected reporting window. That supports the broader claim that AI can dramatically increase vulnerability discovery. It does not tell us how many Bank of America flaws were found, how severe they were, or what percentage survived human validation.
Anthropic CEO Dario Amodei framed the project as a long-term effort to patch software infrastructure before offensive AI capabilities become more widespread.
The scientifically useful takeaway is narrower: AI appears capable of increasing the rate of discovery faster than large organizations can increase the rate of remediation. The missing measurements are false-positive burden, severity distribution, time-to-fix, vendor-versus-internal code share and the pre-AI vulnerability backlog.
This follows the same security shift seen in Anthropic’s open-source bug scanner, IBM and Red Hat’s 400 hidden Java flaws, and Palo Alto Networks’ continuous AI security testing.
A skeptical technical assessment offers a useful counterweight to the strongest claims surrounding Mythos and Project Glasswing.
BitcoinVersus.Tech Editor’s Note:
We volunteer daily to ensure the credibility of the information on this platform is Verifiably True. If you would like to support to help further secure the integrity of our research initiatives, please donate using the QR code provided
For best QR-code scanning results, please scan this donation code from a desktop or larger screen. Mobile screens may prevent camera recognition.
Leave a Reply