Review Systems After AI Audit Reveals Widespread High-Severity Flaws in Bank of America

Bank of America faces significant financial and operational consequences after regulators imposed a $1.2 billion fine for anti-money-laundering failures, according to CSO Online. This penalty coincides with a major security remediation effort triggered by an AI-driven audit that exposed widespread software vulnerabilities.

The bank’s leadership acknowledged the severity of the situation during a conference call regarding third-quarter financial results. CEO Brian Moynihan emphasized the company’s responsibility to correct compliance issues, noting that billions have been invested in technology to combat financial crime. He specified that a couple hundred million dollars in the third quarter was dedicated specifically to AML remediation efforts.

Security Remediation Costs

The IT department faced similar financial pressures addressing technical defects. Moynihan reported that the team spent an amount comparable to the AML remediation budget on fixing software vulnerabilities. This intensive repair process required the recruitment of 1,000 consultants to assist internal staff. The scale of these hires indicates the complexity and volume of the technical issues identified during the audit.

Scope of the Audit

The security vulnerabilities were uncovered after the company received an early release of Claude Mythos Preview, an AI tool developed by Anthropic. In a report to the US House of Representatives Financial Services Committee, Anthropic stated that the tool had already found thousands of high-severity vulnerabilities. The report noted that these flaws were present in every major operating system and web browser.

What to watch

Bank of America shareholders and small-business partners should monitor future quarterly reports for updates on compliance spending. The bank’s statement confirms ongoing investment in both financial crime prevention and technical security. Stakeholders should watch for announcements regarding the completion of the consultant-led remediation projects. Regulatory bodies may also issue further guidance based on the findings from the AI audit.

What made it possible

AI-driven security testing accelerates the discovery of complex software flaws by analyzing code at scale. This technique identifies logic errors and configuration weaknesses that manual audits might miss. It serves the reconnaissance and initial access phases of an intrusion by mapping attack surfaces. Teams usually prioritize high-severity findings to reduce exposure. Check whether your software inventory matches known vulnerable versions. Ensure patching processes can handle large-scale updates without disrupting operations.

What to do and how to stay safe: Bank of America

• Verify that all operating systems and web browsers are updated to the latest stable versions to address known high-severity flaws.
• Review internal policies for anti-money-laundering compliance to ensure they meet current regulatory standards and avoid similar fines.
• Monitor vendor announcements for new security patches, especially those identified by AI-driven audit tools like Claude Mythos Preview.
• Assess your reliance on third-party consultants for security remediation and ensure proper oversight of their access to critical systems.

Step-by-step guide: How Security Advisories Drive Patch Decisions and Reduce Risk

General security guidance from the Shell Bulletin newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Why was Bank of America fined $1.2 billion?

Banking authorities imposed the fine due to identified lax attitudes toward compliance and lacking anti-money-laundering controls.

What tool discovered the software vulnerabilities?

An early release of Claude Mythos Preview, an AI tool from Anthropic, identified the vulnerabilities during an audit.

How many consultants were hired to fix the issues?

CEO Brian Moynihan stated that the IT team hired 1,000 consultants to assist with fixing the software vulnerabilities.