Bank of America hired roughly 1,000 contractors in a recent quarter to remediate flaws surfaced by Anthropic's Mythos model, after one scan reportedly flagged more than 23,000 potential vulnerabilities. The figures come via reporting rather than from the bank.
The number to sit with is not 23,000. It is 1,000 people. A model that finds vulnerabilities at machine speed produces a backlog that can only be cleared at human speed, and the cost of the finding is not the scan - it is the quarter of contractor time that follows it. Most organisations running these tools have not budgeted for the second half.
It also cuts both ways, which is the argument JPMorgan's Jamie Dimon has been making: he has said Mythos-class models could raise cyber risk exposure as much as tenfold. The same capability that finds 23,000 flaws in your code finds them in everyone else's, and defenders have to fix all of them while an attacker needs one. Dimon said on the bank's 13 October earnings call that JPMorgan will not let outside AI agents act inside its systems, and this is the other half of why.