Does Drafting 1,000 Contractors to Address Mythos AI Software Vulnerabilities Just Create New Security Issues?

In its most recent earnings report, Bank of America disclosed that it has onboarded a small army of 1,000 contractors to supplement an existing staff of about 3,000 working to patch security vulnerabilities discovered by Mythos AI.

The story is interesting for two reasons. One is that it puts some real numbers on a phenomenon that is thought to be going on with large organizations everywhere, but that is mostly happening outside of the public eye. The other is yet another speculative question related to AI security: does bringing in that many outside contractors in such a short amount of time potentially create more security problems than it solves?

Mythos AI prompting rapid but temporary staff-ups

The most advanced (and least guardrail-restricted) version of Mythos AI remains in its limited “Project Glasswing” availability, at present still opened up to only about 200 organizations worldwide. Other large companies are known to be using it to find and remediate software vulnerabilities, but few specifics have emerged about the scope of the problem. What few that have indicate that large organizations are now having to tackle large backlogs of bugs, and the Bank of America statements make this more apparent.

Aside from dropping that 1,000 contractors have been brought in, Moynihan has indicated his bank has added over $200 million to its cybersecurity and compliance budget to cover these expenses. We know this because he stressed to investors that this amount was a one-time cost and an investment, expected to yield some $700 million in savings in 2027 (though he wasn’t overly specific about how).

The bank did not provide figures on exactly how many software vulnerabilities it is facing (unsurprisingly). However, given the scope of the staff it has allotted at this point, it is reasonable to assume it is almost certainly thousands and quite possibly tens of thousands. Many of these are also probably “low priority,” but Mythos AI has already proven itself quite good at stringing together lesser vulnerabilities into something far more potent.

Could using contractors for mass AI software vulnerabilities create insider threats?

At first look, all of these recently unearthed software vulnerabilities might appear to be good for the job market. Hiring 1,000 contractors in such a short frame of time is practically unheard of for a bank. There could be a bit of a jobs boom in IT as Mythos AI and other frontier models dig up their piles of software vulnerabilities.

However, it would help a lot to know where the contractors are coming from and for how long they can be expected to stay. Encyclopedic knowledge of a bank’s vulnerability profile is something that would be very interesting to attackers. Are these contractors thoroughly vetted, and how much access do they have? Bank of America’s hiring and labor practices as of late have opened up some questions in this area. And there are numerous stories of more trusted corporate employees poaching internal data before leaving for a competitor; what exactly is stopping a contractor from doing the same with vulnerability information, especially if the whole project is something of a rush job?

Some examples of things that could very easily get out of hand when onboarding this volume of people at this scale: failure to properly vet backgrounds/references/clearances, not enough core employees to properly supervise the contractors, permissions going out of control as tickets are passed around, and “zombie credentials” that linger after the contractors leave, just to name some possibilities. Are these things happening at Bank of America? It’s impossible to know, but organizations can help themselves in this area by being public and transparent about what controls they are applying.