Finding and fixing
The thousand outside contractors disclosed by Brian Moynihan do not enter Bank of America’s employee headcount. Their work nevertheless belongs inside its security effort: repairing software weaknesses exposed by AI models. According to The Next Web’s account of his CNBC interview, about 3,000 bank employees were already doing this work before the consultants arrived in the second quarter. The useful place to examine AI’s workplace effects is this division of tasks: a tool finds a weakness, people repair it, and consultants sit outside the employee count.[1]
The bank’s account shows that automating part of security discovery has not eliminated remediation work. Moynihan names Anthropic’s Mythos among the models involved and says weaknesses appeared in vendors’ code as well as the bank’s. Such a finding produces more than a report: it identifies software requiring repair. In this example, automated discovery sits alongside a separate remediation task performed by employees and consultants. A model finding more problems does not establish that it also completes the work of fixing them.[1]
The protective purpose of this additional work matters for customers and the bank. Discovering a vulnerability has value; leaving it undetected and repairing it are different outcomes. But describing the thousand people as a thousand new bank jobs would also be wrong. They are consultants, and the disclosed number concerns a particular remediation assignment. It cannot establish the bank’s overall net employment effect. My objection concerns the narrow boundary used to count that labor in the productivity story, rather than the decision to assign more people to security.[1]
One task, two contracts
Employee headcount can describe the payroll. An account of all the people producing the security service also needs the consultants. Moynihan explicitly says they are outside headcount. No concealed motive needs to be inferred: the division of one task across two contractual categories is already disclosed. For management’s resource planning, the work does not end at the payroll boundary. Stopping there when evaluating workload makes the externally purchased remediation effort disappear from view.[1]
The spending figure does not price this labor on its own either. Moynihan’s remediation expense of a couple hundred million dollars plus covers both the Mythos effort and repairs to anti-money-laundering controls. Assigning all of it to the model would import another task’s cost into the same calculation. Dividing that sum by the staffing figures to derive productivity per person would be equally unsound. Until tasks and spending align, both the cost attributed to technology and the productivity attributed to workers have an ambiguous denominator.[1]
The concrete request to management is to disclose employee and contractor hours together for this security task, define the remediation scope and match spending to that scope. Such accounting does not itself improve consultant pay or working conditions; it makes the purchased labor available for discussion. Behind the weaknesses AI discovered at Bank of America is an identified repair workforce. Counting that entire workforce in a productivity assessment is the starting point for discussing how its work is valued.[1]