Bank of America hired 1,000 contractors to patch software flaws exposed by Anthropic's Mythos https://www.cnbc.com/2026/10/14/anthropic-mythos-bank-of-america-hiring-cost.html
Why can't AI patch the flaws it found? Lmao. Who is gonna tell them about the bugs being created to fix these? Also note how they hired contractors and not the employees. They think fixing security is one time job. Oh, my sweet summer child.
Oct 15, 2026, 3:36 PM@nixCraft
Security is a process, not a product!
https://www.youtube.com/watch?v=FVCjac42zv4
@nixCraft
Because #InterpolatingAutocomplete ("AI") in a loop with compilers and other deterministic tools ("agent") is like any other heuristic search. Good at finding solutions which can be verified by a machine, but does not care what it bulldozes on the path there.
Or, they can smell blood in the water and the LLM companies are about to get sued out of existence for copyright infringement. And that ignores the behavioral patterns of red teamers they collected and stimulated without consent
@nixCraft I use BoA. I'm scared. 😟
@nixCraft AI or Covid or just stupidity has wiped the collective brains of everyone and now we go back to zero in IT. Right back to the era when no one hired IT staff and they were all temp contractors installing the machines that will replace us…. Just like a few decades ago. For fucks sake. Why is this the timeline we are on?
As Bob is my witless, I did not have “Dadaists write the Matrix” on my brave new world bingo card.
what was that old trope about 1000 monkeys with typewriters?
blah blah blah secure software blah blah blah? :)
@nixCraft I think the point is Mythos detected this errors, and bank of america should fix them. I'm not a pro AI, I hate AI, but in this case, the flaws were there before Mythos (I think)
@nixCraft Yes. The biggest threat posed by AI is the economic threat of software system shutdowns due to the 10% probabilistic errors cause funky hard to see flaws.
@nixCraft why in my day, cobol something something. Heh, but seriously, there’s a reason backend systems still use cobol, one of which is that most people don’t know how to exploit it, even if an exploit was handed to them.
BofA code is so sloppy, users cannot have ad blocking or cross site script blocking enabled to use their site. If you look at the code, it’s a mess of calls and packages, most of which have been cobbled together by contractors and not a dedicated infosec team.
We are no longer in an environment where your systems can be trusted to be secure. People pushing git packages without inspection…insecure. People working on prod, insecure. Any editable text forward facing, insecure. Token auths, insecure. Model weights you didn’t create, insecure.
Ai is able to find flaws faster than they can be patched right now, and people are pushing vibe code to prod, which…whooboy, red team loves to see.
@nixCraft Even if AI were up to patching all the defects without much human supervision, a big consulting firm will make more money by supplying fleets of contractors than by reselling an AI provider.
Also, banks' business involves being responsible for their own money, with lots of regulations. Banks will be more conservative about AI than a startup that needs to show growth potential for funding, an initiative to replace customer service with chatbots, or someone cheating on their homework.
@nixCraft before in the days it was called outsourcing to 3rd world countries.
And just like with outsourcing, you are NOT allowed to say that you did it, but, instead have to keep quiet and let management brag about how successful AI is for their company.
Same 💩, different label.
