On October 14, 2026, Bank of America CEO Brian Moynihan told CNBC the bank hired 1,000 external contractors in the second quarter to patch software vulnerabilities exposed by advanced AI models — including Anthropic's Mythos — and that those contractors are still there today, on top of 3,000 existing staff in that area. The bank spent "a couple hundred million plus" in the third quarter on software remediation. Earlier in 2026, the bank rushed to bolster a broad range of internal and vendor code. Mythos, released in April 2026 to a limited group of banks, tech firms, and government agencies, is built to find and exploit long-standing software flaws. JPMorgan Chase CEO Jamie Dimon says cybersecurity risks "went up 10-fold" after its release. The question for everyone else: what would a frontier model find in your code tomorrow? This 60-second AI code security check scores your AI-audit readiness. Free, no signup.
AI vulnerability discovery is cybersecurity news for everyone because AI models now find bugs in codebases far beyond big banks — including the open-source libraries your business depends on. Attackers use the same AI tools. This 60-second check tells you whether your codebase is audit-ready before someone else's AI finds the flaw first.
The page above scans your code the way frontier models do — 30 seconds, no signup.
Run a static-analysis (SAST) scanner over the repo — open-source options include Semgrep and vibe-code-focused AI code security scanners — plus a secrets scan for hardcoded API keys, then a dynamic (DAST) scan against the running app. No scanner replaces a human review of authentication, data handling, and business logic.
Vibe coding security is the practice of checking AI-generated code for the flaws models commonly introduce: hardcoded secrets, injection flaws, cross-site scripting, disabled TLS verification, and insecure defaults. Research (Veracode's 2025 GenAI Code Security Report) found 45% of AI-generated code shipped a real vulnerability.
Open-source AI code security scanners include vibescan, isitsecure, and AXguard, plus Cloudflare's security-audit-skill and general tools like Semgrep for static analysis and OWASP ZAP for dynamic testing. The right pick depends on your stack: SAST for code, DAST for running apps, secrets scanners for leaked keys.
Mythos is a restricted Anthropic AI model known for its ability to find and exploit software weaknesses. It was released in stages starting in April 2026 to a limited group of banks, technology firms, and government agencies under a program reported as Project Glasswing, so defenders could find flaws before attackers weaponized the same capability.
On October 14, 2026, CEO Brian Moynihan told CNBC that Bank of America hired 1,000 external contractors in the second quarter of 2026 to patch software vulnerabilities exposed by advanced AI models including Mythos, and that those contractors remain in place on top of 3,000 existing staff in that area. He said the bank spent 'a couple hundred million plus' in the third quarter on software remediation and anti-money-laundering compliance.
The same AI capabilities that found decades-old flaws in bank code are available to attackers. JPMorgan Chase CEO Jamie Dimon said cybersecurity risks rose tenfold after Mythos appeared. If you would need months and millions to remediate what a frontier model finds in your code, you are behind — run the audit yourself before someone else does.
Inventory all internal and vendor/third-party code, run AI-assisted audits on it yourself, define patch SLAs in days not weeks, and keep a remediation surge plan — pre-authorized people, budget, and a triage process for a flood of findings. Assume attackers now have the same model capabilities your auditors do.