Bank of America prices AI-exposed technical debt: finding flaws is now cheap and automated, fixing them is not (Linas's Newsletter)
Bank of America is the first major bank to put a number on what defending against AI costs. After Anthropic's Mythos model began exposing flaws in the bank's systems faster than its teams could patch them, chief executive Brian Moynihan brought in 1,000 contractors in the second quarter to work alongside 3,000 internal staff, and put the third-quarter remediation bill at "a couple hundred million dollars plus".
The immediate driver is security, and the response is reasonable. But the flaws being patched are not new. Many sat undetected for years or decades, in the bank's own systems and in its vendors' systems. AI did not create that debt. It made the debt visible, on a timeline set by whoever runs the model rather than whoever owns the code. Every organisation running older systems now carries the same exposure, whether or not it has deployed AI itself.
The numbers deserve some caution. They are Moynihan's own figures, the quarterly bill blends security patching with anti-money-laundering remediation, and no Mythos-attributable share has been broken out. This could also be a one-off clearing of a long backlog rather than a recurring cost. One bank, one earnings call and one newsletter's analysis is thin evidence for a trend. What is harder to dispute is the direction: finding flaws has become cheap and automated, while fixing them remains slow and manual.
That imbalance moves the real question into procurement. Most organisations could not fund a response at this scale, so who pays for AI-exposed flaws will be settled in vendor contracts. Anyone who bought software on yesterday's liability terms could find they own risks they assumed sat with the supplier.
For an executive team the question is not whether the bank made the right call. It is what your own position looks like: how much technical debt would an AI-grade audit of your systems find, how quickly could you fund the fix, and under your current contracts, whose invoice does it land on?
Source: Linas's Newsletter, "Bank of America, Mythos & the Cost of AI Cyber Defense" (19 October 2026), https://lnkd.in/gqBWqF86; underlying CNBC interview with Brian Moynihan (14 October 2026), https://lnkd.in/gbCNeiMr. Figures are the bank's own disclosures: the quarterly total blends security and anti-money-laundering remediation with no AI-specific allocation, and some coverage reported it more loosely as "north of $100 million" (TechRadar); not independently verified.
#CyberSecurity #TechnicalDebt #AIGovernance