Bank of America Patches Flaws Exposed by Anthropic's Mythos Model

Introduction

Bank of America has brought on 1,000 contractors to patch software flaws surfaced by AI models like Anthropic's Mythos, CNBC reports.

Background

Anthropic released Claude Mythos around early April 2026. The model is built for advanced cybersecurity work, including autonomously discovering and exploiting vulnerabilities in software code.

The Findings

Anthropic did not open Mythos to the public. Instead, a preview version went to select major US banks through an initiative called Project Glasswing, which let them scan their internal systems at scale.

The Scans

The scans turned up thousands of vulnerabilities, and one scan alone flagged more than 23,000 potential issues. Most of the findings were rated low to moderate severity, though broader testing also surfaced some critical flaws.

Bank of America's Response

Bank of America was among the early participants testing the model by mid-2026. Timelines for addressing vulnerabilities reportedly shrank from weeks to days after the Mythos findings.

The Impact

CNBC reported that Bank of America hired 1,000 contractors for the patching work. Other reports point to monthly net hires around that figure as the bank builds out operational capacity.

Regulatory Scrutiny

JPMorgan CEO Jamie Dimon has pointed to a potential tenfold increase in cyber risk exposure tied to Mythos. The US Treasury and the Federal Reserve held briefings to walk bank CEOs through the heightened risks associated with Mythos. Regulators have also turned their scrutiny toward vulnerabilities in legacy systems.

Availability

As of October 2026, Mythos versions remain available only to vetted cybersecurity and research users through controlled programs.