Bank of America hired 1,000 contractors to patch software vulnerabilities exposed by AI

ㅤ
The bank accelerated remediation of vulnerabilities in its internal software and third-party vendor code as AI models became more capable of discovering security weaknesses. Moynihan said software remediation and anti-money-laundering compliance efforts together added more than $200 million in third-quarter expenses.
ㅤ
The bank did not disclose how many vulnerabilities were identified or patched.
ㅤ
Experts with Black Hills Information Security and Suzu Labs offer perspectives on the matter.
ㅤ
John Strand, Owner, Black Hills Information Security:
ㅤ
“What do you call a thousand outside contractors helping Bank of America remediate software vulnerabilities? A good start."
ㅤ
“That’s an infosec joke, but it also shows one way AI may actually contribute to job growth in computer security. Finding more vulnerabilities creates more work for the people who have to fix them."
ㅤ
“My bigger concern is the idea that finding and remediating vulnerabilities is going to be an Easter egg hunt. Find all the eggs, put them in the basket, and you’re done. Software doesn’t work that way. It’s constantly evolving, changing, and getting patched. New vulnerabilities and attack paths keep emerging. We’re not going to find everything, fix everything, and then have everything be fine. This is ongoing work.”
ㅤ
Jacob Krell, Senior Director: Secure AI Solutions & Cybersecurity, Suzu Labs:
ㅤ
“Bank of America’s 1,000 remediation contractors confirm what I have argued for a while now, the chokepoint has moved from finding vulnerabilities to fixing them. AI models like Anthropic’s Mythos can surface weaknesses faster than any bank can patch, so remediation capacity becomes the scarce resource, and Moynihan’s $200 million in added quarterly expenses puts a price tag on how scarce."
ㅤ
“Hiring that capacity this way creates its own exposure. A bank’s vulnerability inventory is effectively a targeting package, it maps exactly where the defenses are weak across internal software and third-party vendor code. Handing it to 1,000 outside contractors, roughly one contractor for every three existing security employees, distributes the bank’s most sensitive operational intelligence to people sitting outside its HR controls, monitoring, and enforcement chain. The bank can say the contractors follow the same security practices as employees, but without employee-grade endpoint logging and access oversight, the claim is unverifiable."
ㅤ
“I would want to know how long these contractors stay, what offboarding looks like, and who audits their access to live vulnerability data. The remediation backlog will shrink. Third-party risk like this outlasts every patch those 1,000 contractors ship.”