AI found the bugs. A bank hired 1,000 people to install the fixes.
16 Oct 2026 · News
The models got fast at finding flaws and writing code. The part that still moves at human speed is getting the fix installed, and it now shows up on a bank's earnings call.
AI is no longer the slow step. The slow step is the human-scale queue after it: patches, merges, test runs, and the people paid to push fixes through. That queue is now a line item, and it will keep growing before it shrinks.
On Wednesday Bank of America CEO Brian Moynihan told CNBC the bank brought in outside help after frontier models started exposing flaws in its own and its vendors' software: "We put on 1,000 contractors to help us do the patching work in the second quarter, and those people remain here today, helping us, on top of the 3,000 people we have in that area." On the earnings call he put the third-quarter cost of that work plus separate anti-money-laundering cleanup at "a couple hundred million plus." CNBC called it one of the first times a major US company has put manpower and dollars on defending against Anthropic's Mythos, the restricted model known for finding and exploiting software weaknesses.
The same bank's head count fell by about 3,400 over the year, and Moynihan expects its roughly 130 AI projects to save $700 million in 2027. So the bank is banking on AI to make it leaner while, in the same quarter, paying a temporary army to clean up what AI found. Moynihan's sharpest line was about the sellers: "the people doing the software development are the people trying to sell us the services."
The patch pile is public too. Microsoft's October Patch Tuesday fixed more than 1,400 vulnerabilities, the biggest monthly release it has ever shipped. By iTnews' count that is 42% more than September's record and nearly eight times October 2025. A week earlier Microsoft told security chiefs to add patching staff, expect high volume to continue, and consider patching critical systems within 24 hours instead of waiting for the weekend.
Inside the labs it looks the same. Anthropic wrote this week that it went from about 2,500 code changes merged a day in May to more than 30,000 a day in September. "Coding is no longer the bottleneck," it said. The bottleneck is "all of the developer infrastructure built for human scale: source control, builds, and CI." Seven people built a replacement for git in five months, and Anthropic says a proper merge queue "doesn't make much sense at agent scale."
Five days ago we wrote that Anthropic had found 29,000 possible bugs and run out of people to check them. That week the wait was confirming a bug was real. This week the wait is landing the fix: the contractor, the merge, the restart you keep postponing. The work moved one step down the pipe, and each step down involves more ordinary people and more ordinary companies. A bank is not running agent swarms on a monorepo. It just has old code and new attackers.
Anthropic says its home-built tool only makes sense for enormous codebases. Fair for the tool. Wrong for the problem. Microsoft's release notes and Bank of America's earnings call show the same shape at companies that never asked an agent to write a line. And the one human job Anthropic named inside its own queue was telling Claude "no," which is the job we wrote about in the agent that won't take no. Speed upstream turns into judgment work downstream.
Our call: Microsoft's November Patch Tuesday tops 1,000 fixes again, and by the end of June 2027 at least two more large US banks put a number on AI-driven remediation, in contractors or dollars, the way Bank of America just did. Moynihan says the cost runs down once the backlog clears. It will, for that backlog. The models keep getting better at finding the next one.
When a lab brags about bugs found or code written, the better question is who gets paid to land it. This quarter, at one bank, the answer was a thousand contractors.