Bank of America assigns 4,000 people to fix AI-found vulnerabilities

From discovery to repair

Anthropic gave selected partners access to Mythos in April through Project Glasswing, saying the model had found thousands of serious security vulnerabilities. OpenAI launched its own cybersecurity program, Daybreak, in May.

Early criticism cast the labs’ warnings and proposed safeguards as public relations. The debate later shifted, shaped by incidents such as the Hugging Face breach and independent assessments that found stronger capabilities in newer models.

Bank of America is among the first large US companies to disclose how many people it has put to work fixing vulnerabilities found by AI. That makes the 4,000 figure notable, but it does not tell us how many flaws the company is addressing, how severe they are, or how long repairs take.

The work behind the number

I think the more revealing measure is not the size of the team but how quickly it can shrink. Moynihan expects remediation costs to fall over time, but the announcement gives no timeline or evidence yet that the work is getting cheaper.

The gap between models finding vulnerabilities and companies fixing them is the harder problem. If AI keeps accelerating discovery, the value of its security work will depend on whether the people and processes behind remediation can keep pace.