Bank of America Addresses AI-Discovered Vulnerabilities and AML Fine

Bank of America is addressing a combination of regulatory penalties and technical debt after authorities fined the institution $1.2 billion for money laundering offences. According to CSO Online, banking regulators cited a lax attitude toward compliance as the primary driver for the financial penalty. The institution’s leadership acknowledged the severity of the compliance failures during a discussion of third-quarter financial results. This regulatory action occurred alongside significant technical remediation efforts.

Root cause

The technical issues involved software vulnerabilities identified through an early release of Anthropic’s Claude Mythos Preview. According to InfoWorld, the bank received this preview version, which subsequently revealed security flaws in the institution’s systems. Anthropic reported to the US House of Representatives Financial Services Committee that the tool had already discovered thousands of high-severity vulnerabilities. These findings included weaknesses present in every major operating system and web browser.

Attack path

The source material does not describe an active exploitation chain or a specific adversary leveraging these flaws for unauthorized access. Instead, the exposure was identified through the use of the Claude Mythos Preview scanning tool. According to Anthropic’s report, the tool detected thousands of high-severity vulnerabilities across major software platforms.

Affected versions

The source material does not list specific version numbers for the compromised operating systems or web browsers. Anthropic’s report to the US House of Representatives Financial Services Committee stated that the Claude Mythos Preview tool found vulnerabilities in every major operating system and web browser. This broad categorization implies that multiple versions of widely used software platforms were affected.

Mitigation

Bank of America’s IT team spent a couple hundred million dollars in the third quarter on remediation for the anti-money-laundering controls. According to CSO Online, CEO Brian Moynihan stated that the IT team spent a similar amount fixing software vulnerabilities in the bank’s systems. This technical remediation effort required the hiring of 1,000 consultants to address the flaws identified by the AI tool. The bank also dedicated thousands of employees to combat financial crime, investing billions of dollars in technology overall.

Signals worth monitoring

Security teams should monitor system logs for unexpected changes to software configurations or unauthorized patching activities during large-scale remediation efforts. Analysts typically look for spikes in administrative access logs when thousands of consultants are deployed to fix vulnerabilities. Teams should also verify that new software deployments do not introduce additional high-severity flaws by checking vulnerability scanners after each update. Monitoring for anomalous network traffic from development environments can help ensure that remediation work does not inadvertently expose sensitive data to external networks during the fixing process.

What to do and how to stay safe: Bank of America

• Review your organization’s software inventory to identify which operating systems and browsers are currently deployed and check for known high-severity vulnerabilities.
• Establish a process for testing new security scanning tools in isolated environments before deploying them to production systems to avoid unexpected disruptions.
• Ensure that your incident response plan includes procedures for handling large-scale remediation efforts involving external consultants, including strict access controls and logging.
• Monitor regulatory communications for updates on compliance requirements related to anti-money-laundering and cybersecurity, ensuring your team stays informed about evolving standards.

Step-by-step guide: Attack Surface Management: 6 Common Misreadings and Correct Views

General security guidance from the NetSec Observer newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Did the AI tool cause the $1.2 billion fine?

No, the fine was for money laundering offences due to lax compliance attitudes, not directly caused by the AI tool.

How much did Bank of America spend on technical fixes?

The bank spent a couple hundred million dollars in the third quarter on remediation for AML and a similar amount on fixing software vulnerabilities.

What did the Claude Mythos Preview tool find?

Anthropic reported that the tool found thousands of high-severity vulnerabilities in every major operating system and web browser.