Mythos and the banks: what happens when an AI finds thousands of bugs at once

When an AI model can find software flaws far faster than people can, the bottleneck moves from finding bugs to fixing them. Since April, US banks have been paying for that shift in staff, contractors and money, and Bank of America has now put numbers on it.

What Mythos is

Claude Mythos Preview is an Anthropic model that the company has not released to the public. Anthropic announced it on 7 April 2026 alongside Project Glasswing, a programme that gave the model to a small group of partners for defensive security work. The launch partners included Amazon Web Services, Apple, Google, Microsoft, Nvidia and JPMorganChase, and Anthropic said more than 40 other organisations that maintain critical software also got access.

Anthropic said the model had already found thousands of high-severity vulnerabilities, including some in every major operating system and web browser. A vulnerability is a flaw in software that an attacker could use to break in, steal data or stop a system working. Anthropic said it does not plan to make this preview model generally available.

On 5 May, Anthropic chief executive Dario Amodei told an event that the total count of vulnerabilities found across all software now runs into the tens of thousands, and that most had not been disclosed because they were still unpatched, CNBC reported.

According to CNBC, Anthropic expanded Glasswing in June to more than 150 organisations across 15 countries. On 6 October, Anthropic said existing Glasswing members would move into the top tier of a new access programme for security professionals.

How the banks got pulled in

In the week of 6 April, Federal Reserve Chair Jerome Powell and Treasury Secretary Scott Bessent met the chief executives of major US banks at the Treasury to discuss the cyber risks of Mythos, CNBC confirmed on 10 April. Citing Bloomberg, CNBC said Bank of America's Brian Moynihan, Citigroup's Jane Fraser, Goldman Sachs's David Solomon, Morgan Stanley's Ted Pick and Wells Fargo's Charlie Scharf attended. JPMorgan's Jamie Dimon could not.

Within days, both JPMorgan and Goldman Sachs said on earnings calls that they were testing Mythos. Dimon said AI was making banks more vulnerable before it made them safer, and warned that banks also depend on exchanges and other outside systems.

The Fed itself was slower. CNBC reported on 21 July that the central bank was still trying to get access to Mythos as of 15 July, under Powell's successor, Kevin Warsh.

The Bank of America numbers

On 14 October 2026, after its third-quarter results, Moynihan told CNBC that Bank of America brought on 1,000 contractors in the second quarter to patch flaws in its own and its vendors' software. Those contractors are still there, working alongside about 3,000 staff in that area.

He told analysts the bank spent a couple of hundred million dollars or more in the quarter on software remediation together with anti-money-laundering compliance work. The figure combines the two, so it is not a clean cost of Mythos alone. Moynihan said he expects the spending to fall, arguing that "once you patch, you don't have to patch as much."

Back in July, he had already told Bloomberg Television that these tools were changing both the amount of work and how fast banks have to deal with flaws.

Why fixing faster is not free

Finding a flaw is only the first step. Someone has to write a fix, test it, and install it on live systems. CNBC reported in May that patching often takes days or weeks, and that some patches require key systems to be taken offline.

Moynihan also pointed to a vendor problem: much of the code a bank runs is written by companies selling it services, so the bank has to make sure those suppliers do their share.

Our take

The headline number is the contractors, not the bugs. A model that finds flaws is cheap compared with the people needed to fix them, and Bank of America's 1,000 contractors are a direct measure of that gap.

Speed carries its own risk. Every rushed change to a banking system is a chance to break something, and a bank that patches far more often than before is making far more of those changes. Older systems are the hardest case. Software whose original maker no longer supports it has no vendor to write a patch, so the bank must fix it itself, wrap it in extra protection, or replace it.

For customers, the likely effect is mostly invisible. More maintenance can mean more planned downtime or occasional glitches in apps and payments. The alternative, leaving known flaws open while attackers gain similar tools, is worse. CNBC reported in May that security firms could already reproduce some Mythos findings using older public models.

What to watch

• Other banks' disclosures. Whether more lenders put a cost or headcount on remediation in their results.
• Whether costs fall. Moynihan expects remediation spending to decline. Later quarters will show if it does.
• Outages. Any bank outage blamed on a rushed patch would test the case for patching faster.
• Access. Who outside the first group, including regulators and smaller banks, gets Mythos-class tools, and when.