Bank of America is reportedly devoting about 4,000 people—roughly 3,000 internal staff and 1,000 outside contractors—to fixing software vulnerabilities that AI systems, including Anthropic's Mythos, have identified across its codebase. The numbers, reported by CNBC and picked up by The Decoder, offer a concrete case study of how artificial intelligence is changing the nature of security work: not by eliminating human roles, but by changing the volume, speed, and type of work that people are asked to do.

The development matters beyond banking. For HR leaders, IT managers, and remote-first organizations, it raises a practical question: if AI can surface problems faster than teams can patch them, how should companies build and flex a workforce to keep up?

AI is accelerating the discovery of vulnerabilities

Software security has traditionally depended on human auditors, penetration testers, and periodic code reviews to find weaknesses. That process can be slow and inconsistent. AI models such as Anthropic's Mythos can analyze large volumes of code, flag suspicious patterns, and suggest where vulnerabilities may exist—often in a fraction of the time a manual review would take.

The result is a shift in the bottleneck. Instead of struggling to find enough issues to justify a remediation team, organizations can now generate a backlog faster than they can close it. Bank of America's response—dedicating 4,000 people to the remediation effort—suggests that AI-driven discovery has outpaced the bank's existing internal capacity. That is not a sign of AI failure; it is a sign that the technology is working well enough to expose how much human judgment and skilled engineering are still required to actually repair systems.

A surge in specialized, often flexible work

For HR and staffing functions, the Bank of America case highlights a demand pattern that is becoming more common: sudden, specialized workforce needs tied to a specific technology initiative. The bank reportedly brought in about 1,000 external contractors to supplement internal staff. That kind of surge hiring is rarely simple. It requires sourcing people with the right security clearance or compliance training, onboarding them quickly, and coordinating distributed teams that may span time zones and employment arrangements.

It also blurs the line between permanent and contingent work. A vulnerability remediation push may last months, not years. Once critical issues are patched, the needed headcount may decline. That reality favors flexible staffing models, where organizations can scale up without adding permanent overhead and scale down when the project winds down. For remote-capable security roles, geography matters less than expertise, which expands the talent pool but also increases competition for the same specialists.

What this means for HR and business leaders

AI in the workplace often triggers fears of job loss. The more immediate lesson from Bank of America is that AI is rearranging work rather than making it disappear. Security professionals are not being replaced by models that find bugs; they are being redeployed to verify AI output, prioritize fixes, and implement changes in complex production systems. That requires both technical skill and a high degree of trust in AI-assisted workflows.

For leaders, the strategic challenge is less about whether to adopt AI and more about how to organize around it. Teams may need training to read AI-generated vulnerability reports, distinguish high-risk findings from noise, and manage a much larger volume of remediation tasks. Some internal staff may be pulled from other projects, creating secondary resourcing gaps elsewhere. Clear communication about temporary reassignments, contract roles, and remote work expectations becomes essential.

There is also a risk management dimension. Moving quickly to fix hundreds or thousands of vulnerabilities can introduce new errors if workers are rushed or poorly coordinated. HR, security leadership, and procurement need to align on workforce quality, access controls, and contractor oversight—especially in heavily regulated industries like banking.

The Bank of America effort may be an early example of a broader pattern. As AI tools become better at finding problems in code, infrastructure, and business processes, companies will need to decide whether to build larger permanent teams, rely on external partners, or create internal pools of flexible workers who can move between AI-driven projects. For HR teams, sourcing specialized security contractors at speed is a reminder of the value of flexible staffing models—something platforms like XMF are designed to support.

Ultimately, the organizations that benefit most from AI will be those that treat it as a force multiplier for human expertise, not a substitute for it. That means planning for surges, investing in skills, and designing workforce models that can flex when AI surfaces more work than the current team can handle.

Originally published by XMF, inspired by publicly reported industry news.