AI Found the Bugs. Now 4,000 People Are Fixing Them

According to The Decoder, Bank of America has put 4,000 people to work fixing software vulnerabilities uncovered by advanced artificial intelligence models, including Anthropic's Mythos. The workforce consists of 3,000 internal employees and 1,000 external contractors who have been tackling code repairs since the second quarter.

The Real Bottleneck in AI Security

When labs like Anthropic and OpenAI launched specialized security models such as Mythos and Daybreak, skeptics dismissed the capability warnings as public relations. However, real-world incidents like the Hugging Face breach proved the threat was concrete. The bottleneck is no longer finding security flaws, but the sheer volume of work required to patch them.

CEO Brian Moynihan reported that the bank spent hundreds of millions of dollars in the third quarter on software tasks and anti-money-laundering requirements combined. While patching costs are currently high, the bank expects these expenses to decrease over time as remediation workflows improve.

How to Handle AI-Generated Vulnerability Lists

If your engineering team uses AI to scan codebases, you will quickly face a tidal wave of reported vulnerabilities. Managing this output requires a structured triage process rather than ad-hoc fixes.

• Filter by severity: Group AI-flagged issues by actual exploitability, ignoring low-risk theoretical warnings initially.
• Establish triage squads: Dedicate specific teams to review AI output, filtering out false positives before assigning code patches.
• Automate remediation where safe: Use automated dependency updates for standard libraries, reserving human review for core business logic.
• Track remediation time: Measure how long it takes from AI detection to production deployment to avoid security debt pileups.

Verdict: Is AI-Driven Code Auditing Worth It?

Advanced security models successfully uncover deeply hidden flaws that traditional static analysis tools miss. However, the Bank of America case study proves that adopting these systems requires an immediate expansion of engineering bandwidth. If your team cannot scale its patching capacity, automated vulnerability discovery will only create operational paralysis.