AI found the flaws. You don't need 1,000 contractors to fix them.
When AI finds faster than people can fix
On October 14, 2026, Bank of America's CEO said the bank brought in 1,000 contractors to patch software flaws surfaced by frontier AI models, including Anthropic's Mythos. "We put on 1,000 contractors to help us do the patching work in the second quarter," Brian Moynihan told CNBC. Those contractors work on top of the 3,000 people the bank already has in that area (ITPro, The Next Web).
That is what the new normal looks like. Mythos-class models scan code and dependencies and return findings at a volume no security team has seen before. Anthropic said it plainly in June 2026: "The bottleneck in cybersecurity is now verifying, disclosing, and patching the large numbers of vulnerabilities that Mythos-class models can surface."
Finding is now a machine's job. Fixing is still a person's job, and the only way to scale people is to hire more of them. Most organizations cannot add 1,000 contractors, and even the ones that can should not have to.
The answer is a two-sided weapon: AI models that find on one side, and AI that validates and fixes on the other. That is how an organization fights AI exploitation with AI.
Why every AI finding turns into human work
A finding from an AI model is the start of the work, not the end. Each one still has to go through the same manual steps:
- Validate it. Is the flaw real? Does it affect the version actually running in production?
- Find a fix. Is there an upstream patch yet? Often there is no CVE and no fixed release at all.
- Make the fix fit. The fixed release may be a major upgrade away, or the version you run may be end of life.
- Prove it. Build, test, and show the auditor the risk is gone without breaking anything.
Multiply those steps by thousands of findings and you get an army of contractors. Meanwhile attackers have access to the same class of models. Every day a finding sits in a queue is a day someone else can turn it into an exploit.
Side one: AI that finds
The first edge is already in your hands, or soon will be. Mythos-class models read code the way a senior researcher does, at machine speed. Pointed at your applications and the open source they depend on, they surface high and critical flaws that traditional scanners never matched, many of them with no CVE yet.
That is a gift and a burden. You now know about far more risk than before, and so does anyone else running the same models. Discovery is no longer what holds you back. What holds you back is the queue of findings it creates.
Side two: AI that fixes
Seal is the second edge. It takes the findings your AI models and scanners produce and does the work the contractors would do, with agents instead of headcount:
- Validate. Confirm the flaw applies to the exact package and version you run.
- Isolate. Take only the lines that matter from the upstream fix, as soon as it lands, even before a CVE or a fixed release exists.
- Backport. Apply them to your version, including end of life versions no upgrade can reach.
- Verify. Build, test, and prove the vulnerability is gone.
- Deliver. The sealed version lands in Artifactory, Nexus or your CI, and your scanner sees the finding close.
Seal's pre-CVE program adds a head start on top. Seal's own agents watch upstream projects continuously and issue warnings and patches for flaws AI surfaces before a CVE is published. Across Seal's coverage, the median head start before the public advisory is 7.5 days. That is a week in which an attacker with a model sees an open door and you have already closed it.
One weapon, two edges
Put the two sides together and AI meets every open source flaw at both ends. Your models find it. Seal's agents validate it, fix it on the version you run, and hand it back to your pipeline. When Seal's pre-CVE program catches the upstream fix first, you are patched before the finding ever reaches a queue.
The contractor queue in the middle disappears. Your scanner remains the source of truth, and the fix layer does the work that used to need a small army: making the risk go away on the versions you actually run.
The fix, without the migration. A sealed version is your exact version plus the security patch, 6.5 lines on average.
- 01IsolateTake only the added lines from the upstream fix, as soon as it lands, even before a CVE or a fixed release exists.
- 02BackportApply them to the exact version you run.
- 03VerifyBuild it, test it, prove the vulnerability is gone.
- 04DeliverThe sealed version lands in your artifact repo and CI.
- 05CloseYour scanner sees a fixed version and the finding closes.
From upstream fix to a closed finding, before the CVE is published.
A contractor army or a fix layer
Both routes aim at the same goal: clear the AI findings before attackers use them. Only one of them scales with software instead of headcount.
| Contractor army | Seal fix layer | |
|---|---|---|
| Validating findings | People, one finding at a time | AI agents, on the exact version you run |
| Flaws with no CVE yet | Wait for the advisory | Pre-CVE patch, 7.5 day median head start |
| End of life versions | Upgrade or rewrite | Backported fix, no upgrade |
| Speed on critical and high | Depends on who is free | 72 hour contractual SLA, usually faster |
| Change to your code | Upgrades and migrations | About 6.5 lines per fix, version pins stay yours |
| Audit evidence | Assembled by hand | Standard evidence for every fix |
| How it scales | Hire more people | Software |
Seal has already patched more than 20,000 CVEs this way, across the libraries customers actually use. Hardened images do not change this picture: they protect what ships next, while the AI findings sit in what is already running.
Fight AI with AI
If you are turning Mythos-class models on your stack, plan for what comes after the findings. Three steps get you there:
- Keep finding with AI. The models are the best map you will ever have of your exposure.
- Fix with AI too. Connect the findings to a fix layer that validates, patches and verifies them on the versions you run, so the queue never forms.
- Get ahead of the CVE. Use pre-CVE warnings and patches so the flaws your models and attackers find are already closed.
Bank of America needed 1,000 contractors on top of 3,000 staff to keep up. You can reach the same objective with AI on both sides.
Seal Security is the fix layer for the AI era. To see how Seal clears the findings your AI models produce, book a demo.
