Bank of America Hired 1,000 Contractors to Fix What AI Found: The AI Patch Bill, the ECB’s 31 October Deadline and What Suppliers Should Expect (AI Trends, 15 October 2026)

What’s trending in AI on 15 October 2026: The bill for AI-powered bug hunting has started showing up in bank earnings. On Wednesday, Bank of America chief executive Brian Moynihan said the bank brought in roughly 1,000 outside contractors in the second quarter to fix software weaknesses surfaced by advanced AI models, including Anthropic’s Claude Mythos. They work alongside about 3,000 of the bank’s own technical staff. A day earlier, Reuters reported that US and European banking supervisors are now questioning lenders in detail about AI cyber risk, and the European Central Bank’s deadline for banks to deliver anti-AI-attack plans falls on 31 October. Then on Thursday, Cohere signed a letter of intent to buy AISLE, a young company whose AI found most of the security flaws fixed in the latest curl release. The pattern is the same in all three stories: AI has made finding flaws cheap, and fixing them is now a budget, staffing and supervisory problem. Below: what Bank of America actually disclosed, why the fixing bill is so large, what regulators are asking, how the pressure will roll down to every company that sells software or services to a bank, and a worksheet for sizing your own remediation capacity.

Key takeaways

AI-found flaws now need a workforce. Bank of America added about 1,000 contractors to roughly 3,000 staff to patch weaknesses AI models exposed, in code used by the bank and its vendors.
The cost is material. Moynihan put the quarter’s remediation spending at a couple of hundred million dollars plus, a figure that also covers anti-money-laundering fixes.
Supervisors are asking. The Fed, OCC and FDIC are questioning banks about AI agents and controls, and the ECB wants action plans from significant banks by 31 October.
Vendors are next. Regulators want banks to map AI use across third-party providers, so suppliers should expect sharper patching and AI questions in due diligence.
Finding is cheap; fixing is not. XBOW built a full Chrome exploit chain for about $40,000 of compute in six days, while the fix side is measured in thousands of people.

AI has made finding software flaws cheap. Fixing them is now a line item in bank earnings.

1. What Bank of America disclosed

Moynihan made the comments around the bank’s third-quarter results on 14 October, first to CNBC and then on the earnings call, according to The Register and The Next Web. The core facts are simple. In the second quarter the bank hired about 1,000 contractors to repair software weaknesses exposed by advanced AI models, one of which was Mythos. They joined roughly 3,000 of the bank’s own people already doing the work, and because they were hired as consultants they are not counted in the bank’s headcount. Moynihan said the weaknesses sat in code used both by the bank and by its outside vendors, and that the bank brought in outside help as concerns grew about how it would handle what Mythos was finding.

On cost, he was less precise. He described the quarter’s remediation spending as a couple of hundred million dollars plus, but that figure bundled the Mythos work together with repairs to anti-money-laundering controls, which the bank is also fixing after more than $1.21 billion in Treasury penalties announced on 13 October. He did not split the two, and he said he expects the Mythos share to shrink as the initial wave is cleared.

The same AI wave that promises savings also generated a large, near-term repair bill.

The other side of the ledger is just as interesting. The Register reports Moynihan saying the bank’s tech engineering workforce is about 10% more efficient, that it runs around 130 AI projects each expected to return two to three times its cost, and that AI should deliver $250 million to $300 million of benefit in 2026, rising to $700 million by the end of 2027. The bank did not explain how those figures are calculated.

2. Why the fixing bill is so large

Anthropic made Mythos available to a limited set of organisations in April through Project Glasswing, and the model quickly earned a reputation for finding complex flaws faster than human teams. The Register recalls that Mozilla’s CTO said Mythos found 271 flaws in Firefox 150. JPMorgan’s Jamie Dimon said in May that his bank had hundreds of people working on the findings full-time. We covered the first signs of this pressure in AI broke the bug bounty, when a Mythos-found flaw was exploited within a day of disclosure.

The economics explain why banks are hiring. A single finding is cheap to produce. As we noted in this morning’s ransomware report, the security firm XBOW disclosed on 13 October that its researchers, directing AI agents built on OpenAI’s publicly available GPT-5.6 Sol, assembled a three-bug Chrome exploit chain in six days for about $40,000 in API charges. Google paid $250,000, the first full-chain payout under a Chrome reward introduced in April, and has fixed all three bugs. Each fix, by contrast, needs someone who understands the code, a test plan, a change window, regression checks and often a vendor’s cooperation. Multiply that by thousands of findings across hundreds of applications and the labour adds up fast.

Not a like-for-like comparison, but it shows where the effort now sits.

That is the same find-fix gap Anthropic acknowledged when it launched free scans for open-source projects, which we covered in AI can find the bugs. Who fixes them? The difference this week is that we now have a hard number from a large regulated company on what closing the gap costs in people. If one AI-assisted scan can produce weeks of engineering work, patch capacity, not scanning, becomes the limit.

3. What bank regulators are now asking

Reuters, citing six people familiar with the matter, reported on 13 October that the Federal Reserve, the OCC and the FDIC are sending written and verbal questions about advanced AI to large, mid-size and smaller banks. The questions cover whether banks use Chinese-developed technology, whether they use AI agents in cyber defence and whether they can control increasingly autonomous systems: what limits are placed on agents, how their actions are approved and audited, what stops them exceeding their authority, whether humans stay in key decisions and how the systems can be shut down. US regulators are still gathering information and have not issued prescriptive rules. They declined to comment.

Europe is further along. In a letter dated 7 July 2026, the ECB asked significant institutions for an action plan against AI-driven cyberattacks by 31 October, according to KPMG. The letter names six areas for immediate action, shown below. Reuters adds that euro zone banks must map AI use across their businesses and their third-party providers and show they can switch systems off and restart them in a controlled way, and that significant gaps remain at some firms. In the UK, supervisors are encouraging the largest banks to look at isolated “bare metal” recovery systems that can take over if primary systems are compromised.

A useful template even if you are not a bank: these six areas map neatly onto any AI-era security plan.

Supervisor	What it is doing	Status	Signal for suppliers
Fed, OCC, FDIC (US)	Written and verbal questions on AI agents, controls, shutdown and Chinese technology	Information gathering, not yet prescriptive	Expect questions on how your AI agents are limited, logged and stopped
ECB (euro zone)	AI cyber action plans from significant banks, covering six areas	Due 31 October 2026	Banks must map AI across third-party providers, so they will ask you
Bank of England / UK supervisors	Encouraging large banks to examine isolated “bare metal” recovery	Collaborative, no new requirement planned	Recovery and restore commitments in contracts will get more scrutiny
IMF (global)	Warned against complacency about cyberattacks in global markets	Advisory	Board-level attention to cyber resilience is rising

Sources: Reuters via Insurance Journal (13 Oct 2026); KPMG. Final column is Delana analysis.

This sits alongside other bank moves we have tracked, from JPMorgan blocking outside AI agents from customer accounts to the South Korean bank breaches that CrowdStrike now links to AI tools. Boston Consulting Group’s Sukand Ramachandran summed up the shift for Reuters: “rapid recovery matters as much as prevention.”

4. Why this rolls downhill to every supplier

Two details make this more than a banking story. First, Moynihan said the flaws were in code used by the bank and its vendors. Second, European supervisors want banks to map AI use across their third-party providers. Put those together and the likely next step is obvious: banks will push the same scrutiny onto the software companies, managed service providers, fintechs and consultancies they rely on. If you sell to a bank, or to a company that sells to a bank, expect due diligence questionnaires to get sharper on three things: how quickly you patch, whether you have scanned your own code with AI tools, and how you control any AI agents that touch customer data or systems.

A backlog that was tolerable when findings arrived slowly becomes a commercial risk when a customer can run an AI scanner against what you ship. Patch deadlines were already tightening before this, as we explained in are you prepared for stricter patch deadlines?, and Microsoft’s latest report showed how far attackers have compressed the window between disclosure and exploitation, covered in our 30-day plan.

5. The vendor market is reorganising around it: Cohere buys AISLE

On 15 October, Canadian AI developer Cohere signed a letter of intent to acquire AISLE, according to The Logic and Techzine. No price was disclosed. AISLE was founded in 2025 by Ondrej Vlcek, the former chief executive of Avast, with Stanislav Fort and Jaya Baloo, and has offices in San Francisco and Prague. Its AI systems look for unknown vulnerabilities, check the findings and help develop fixes. Techzine reports that in its first year AISLE found more than 500 previously unknown vulnerabilities across more than 100 codebases, including all twelve in OpenSSL’s January release and 18 of the 24 CVEs in curl’s most recent release, with maintainers reviewing the findings independently.

Cohere plans to form a unit called Cohere Cyber, with Vlcek as senior vice-president, Baloo as Cohere’s global chief information security officer and Fort leading AI security research. Cohere sells largely to governments and regulated industries, often on customers’ own infrastructure or on systems cut off from the internet, so the deal is aimed squarely at the kind of buyer now under supervisory pressure. Its chief executive, Aidan Gomez, acknowledged in September that Cohere’s models trail OpenAI’s and Anthropic’s in coding and cybersecurity.

The pace is the point: plans that assume an annual patch cycle are already out of date.

6. Worksheet: size your own remediation capacity

This worksheet takes a spreadsheet and an hour of your security and engineering leads’ time. It answers one question before a customer, auditor or regulator asks it: if an AI scan tripled our findings next month, could we fix them in time?

Line	What to fill in	How to get the number	Example
A	Open high and critical findings today	Export from your scanner, bug tracker and vendor advisories	120
B	New high and critical findings per month	Average of the last three months	40
C	AI multiplier	Assume 2 to 3 times B once you, a customer or an attacker runs AI scanning against your code	3
D	Engineer-days per fix	Median time from triage to deployed, tested fix	2
E	Engineer-days available per month for fixes	People who can patch multiplied by days actually spent fixing	150
F	Monthly demand	B multiplied by C multiplied by D	240
G	Monthly gap	F minus E; a positive number means the backlog grows	90
H	Months to clear today’s backlog	(A multiplied by D) divided by (E minus B multiplied by D), using today’s rate B rather than F	3.4 at today’s rate; never at the AI rate

Delana worksheet. Example figures are illustrative only.

If line G is positive, you have the same problem Bank of America solved with contractors, just smaller. Here is how to act on the result, in order:

Cut D before you add people. Automated tests, staged rollouts and pre-approved change windows shrink the time per fix more cheaply than hiring.
Triage by exposure, not score. Fix what is internet-facing, actively exploited or reachable by AI agents first, as the ECB’s first area suggests.
Retire what you cannot patch. Every unused application, plugin or library removed is a permanent cut to B.
Put vendors on the clock. Ask key suppliers for patch timelines and whether they scan their own code with AI tools, and write it into renewals.
Pre-arrange surge capacity. A retainer with a managed security or development partner is cheaper than an emergency hire when a big batch lands.
Prove you can recover. Test a restore of a critical system from clean backups, because supervisors are now treating recovery as seriously as prevention.
Report the gap upward. Give leadership lines A, F and G each quarter so remediation is budgeted, not discovered.

7. The bottom line

For two years the AI security debate centred on whether models could find serious flaws. That question is settled. This week’s news is about what happens next: one of the largest US banks needed about 4,000 people to keep up, supervisors on both sides of the Atlantic want proof that banks can patch fast and recover, and AI companies are buying security teams to sell to exactly those customers. For everyone else: measure remediation capacity now, while the backlog is still yours to discover.

Frequently asked questions

Why did Bank of America hire 1,000 contractors?

Chief executive Brian Moynihan said the bank brought in about 1,000 contractors in the second quarter to fix software weaknesses exposed by advanced AI models, including Anthropic’s Claude Mythos. They work alongside roughly 3,000 bank staff, and the weaknesses were in code used by the bank and its vendors.

How much is the AI remediation costing Bank of America?

Moynihan described the quarter’s remediation costs as a couple of hundred million dollars plus, but that figure also includes fixes to anti-money-laundering controls. He did not separate the two and said he expects the Mythos-related share to decline.

What is the ECB’s 31 October 2026 deadline?

In a letter dated 7 July 2026, the European Central Bank asked significant banks to submit action plans against AI-driven cyberattacks by 31 October 2026. The plans cover six areas: prioritising vulnerabilities, faster patching, AI-powered detection and response, governance and third-party risk, zero-trust defence in depth, and crisis management and recovery.

What are US bank regulators asking about AI?

According to Reuters, the Federal Reserve, OCC and FDIC are asking banks whether they use Chinese-developed technology, whether they use AI agents in cyber defence, and how they limit, monitor, audit and shut down autonomous systems. The regulators are gathering information and have not issued prescriptive rules.

Why is Cohere buying AISLE?

Cohere signed a letter of intent on 15 October 2026 to buy AISLE, an AI vulnerability-discovery company founded in 2025. Cohere plans a Cohere Cyber unit to sell security tools to governments and regulated businesses and to strengthen its own models’ security capabilities. No price was disclosed.

Does this matter if my company is not a bank?

Yes, especially if you supply banks or other regulated firms. Supervisors want banks to map AI use across third-party providers, so suppliers should expect tougher questions on patch speed, AI scanning of their own code and control of AI agents. Measuring your remediation capacity now is the best preparation.