Finding software flaws has become the easy part for America’s biggest banks. Fixing them is proving slow, labour-intensive and expensive.
Bank of America has brought on 1,000 outside contractors to patch weaknesses in its own systems and in software supplied by vendors, after advanced artificial intelligence models exposed more problems than its teams could handle. Chief executive Brian Moynihan told CNBC the contractors joined in the second quarter. They are working alongside about 3,000 employees already assigned to remediation.
Discovery outpaces repair
The models behind the scramble include Mythos, a cybersecurity-focused system from Anthropic that is designed to find vulnerabilities in code far faster than human reviewers. Anthropic has not made it publicly available. A preview version went instead to selected large US banks through an initiative called Project Glasswing, so they could scan their own systems at scale.
The scans turned up thousands of potential weaknesses, with one reportedly flagging more than 23,000. Such findings are not confirmed breaches. Most were reported to be of low or moderate severity. But each one still has to be assessed, patched, tested and deployed. Reuters reported earlier this year that fixes banks once deferred for weeks are now being completed within days, and that the heavier workload raises the possibility of more frequent system outages. Banks are expected to schedule downtime carefully to limit customer disruption.
Moynihan has described the change as a major increase in both the volume and the pace of work needed to keep systems secure. He has said the bank is working with outside providers and other institutions to manage the risk.
A costly quarter
The additional staffing helps explain why expenses rose in the third quarter, though it is not the only reason. Moynihan grouped the software remediation with anti-money-laundering compliance work, describing the combined quarterly cost as a couple of hundred million dollars or more. The figure cannot be read as the price of fixing AI-found flaws alone.
The bank’s results were disappointing. Third-quarter profit fell 17% to $6.93 billion, or 91 cents a share. Revenue rose 3.2% to $30.12 billion but missed expectations by roughly $570 million, largely because of weaker trading. Combined bond and equity trading revenue dropped 5%, even though the bank had told analysts a month earlier to expect a flat result. Net interest income, a key measure of lending profitability, rose 7.9% to $16.6 billion and edged past forecasts. The miss ended a streak of six consecutive quarters in which the bank beat analysts’ profit estimates.
The $1.2 billion penalty
Much of the shortfall traces to a $1.2 billion penalty announced a day before the earnings report. US authorities accused the bank of failing to report billions of dollars in suspicious transactions, in what regulators described as sanctions and anti-money-laundering violations. Excluding the penalty, Bank of America said it earned $8.1 billion, or $1.08 per share, with adjusted earnings per share up 4% from a year earlier. Moynihan said he was confident the bank is on the right course to remediate the issues. The shares fell more than 3% in premarket trading after the results.
Cutting costs with AI, too
The same technology causing the bank’s security headaches is also central to its efficiency plans. According to reports, Bank of America is running roughly 130 internal AI projects aimed at saving about $700 million by 2027, and it has trimmed around 3,400 jobs over the past year. The bank has previously said it processes hundreds of thousands of AI prompts from employees each day, and that about 19,000 of its developers use AI-assisted coding tools.
The contrast illustrates a wider tension in banking. AI tools can cut costs and speed up development, yet the same class of tools can expose long-hidden weaknesses at a speed institutions are not used to.
A mixed earnings week for Wall Street
Bank of America’s results sat within a patchy reporting season. Goldman Sachs delivered a standout quarter, beating profit forecasts by roughly 30% on a surge in equities trading. JPMorgan Chase missed estimates for the first time in almost three years. Jamie Dimon, the bank’s chief executive, warned that large fiscal deficits, sticky inflation, elevated asset prices, rising interest rates and geopolitical conditions continue to shift beneath the surface. Despite generally strong figures, bank shares fell on their respective reporting days.
What to watch
Investors and regulators will want to know how quickly banks can clear their backlogs of AI-identified vulnerabilities, and whether spending on remediation eases or becomes a permanent line in the budget. For customers, the immediate effect is likely to be invisible, apart from the occasional scheduled maintenance window. For the industry, the 1,000 contractors are an early measure of what happens when machines find problems faster than people can repair them.
