1,000 contractors to fix what AI found

iPrompt

THE AI NEWSLETTER THAT TURNS NEWS INTO ACTION

ISSUE #158
WEDNESDAY · 21 OCTOBER 2026

THE HOOK

Bank of America hired 1,000 contractors in the second quarter to patch software flaws that AI models had exposed, its chief executive said last Wednesday. Anthropic’s Mythos was one of those models. The same day, curl, a free data-transfer tool built into billions of devices, shipped a record 24 vulnerability fixes. Six days later its lead developer wrote: ‘We must act to survive.’

OUR ANGLE

Finding is cheap now. Fixing isn’t.

Bank of America bought capacity: the contractors joined about 3,000 of its own staff. Brian Moynihan told analysts the third quarter carried ‘a couple hundred million plus’ for software fixes and anti-money-laundering work, though he expects it to ease: ‘Once you patch, you don’t have to patch as much.’

curl is changing how it works. From 26 October, it will handle low- and medium-severity reports as public GitHub issues, so more people can help assess them, and keep only high and critical private. Daniel Stenberg is clear that this spreads the work rather than shrinking it. AI security start-up AISLE says it found 18 of the 24 fixes.

PostgreSQL has moved version 19 from late September to about 19 November and pulled eight to ten features, with AI-assisted review part of the reason. Committer Peter Eisentraut put it carefully: ‘The effective quality bar has been raised after the time the feature was written and committed.’

My read: pointing AI at your own work is now the easy part. It returns more than you can fix, so the skill that pays is triage: deciding before you open the list what gets fixed now, what waits for a natural moment and what you knowingly leave, and who owns each call. An unsorted list records what you were told. A sorted one shows what you decided.

Prediction: by 30 June 2027, a single curl release will fix more than 24 vulnerabilities, beating 8.23.0’s record. Stenberg expects no let-up ‘within the next several months’.

Go deeper: How to triage AI findings works through a fictional firm’s 287 contract findings, including the checks that catch what a first sort gets wrong.

ALSO THIS WEEK

Accenture puts Claude on a $29 meter

Accenture has told many employees it will now spend only $29 a month per person on Claude, 404 Media reported last Thursday. Some had been spending as much as $1,000, and are ‘scrambling’ to keep their usage. 404 Media says other companies are pulling back too, once they see how fast staff get through tokens.

404 Media · 15 October

Fewer job ads for finding flaws

US cybersecurity job ads fell 26.4% in the first nine months of 2026, to 235,786, a four-year low, according to CyberSN. Penetration-tester ads fell 45.9%; AI security engineer ads rose 268.3%. These are postings, not jobs, and the report shows what changed, not why, so treat any story about the cause, mine included, as a guess.

SecurityWeek · CyberSN report

Meta’s new business terms start on 30 October

Keep using Meta’s business tools after 30 October and you accept terms that, legal experts told Nieman Lab, let Meta crawl websites ‘associated with’ your account and train its AI on them. There’s no opt-out short of stopping. Meta points to robots.txt, but Nieman Lab says the terms give Meta an opening to argue they override blocking instructions. Decide before the 30th.

Nieman Lab · 15 October

PROMPT OF THE WEEK

Turn a findings list into a fix queue

Use it when an AI review hands you more than you can fix. Include the documents so it can point to evidence, and set the scale and capacity first.

Here are findings from an AI review and the documents it reviewed. Don’t fix anything. Help me decide what to fix, in what order, and what to leave.

DOCUMENTS: [attach or paste]
SCALE: HIGH = [e.g. could cost us money, a client or legal exposure this year]; MEDIUM = [real, but can wait for a natural moment such as renewal]; LOW = [everything else]
CAPACITY: [e.g. four hours a week until 4 December]
FINDINGS: [paste the list]

1. Merge duplicates, including the same issue under different headings. Say how many remain.

2. For each finding, give its evidence: quote the text and say where it is. If the finding is that something is missing, name the document and where you looked. If you can’t support it, mark it UNVERIFIED. Don’t drop it.

3. Rate every finding against my scale, with one line of reasoning. Rate UNVERIFIED ones by what they’d cost if true.

4. Sort into FIX NOW (HIGH first), FIX LATER (with the trigger, e.g. next renewal) and WON’T FIX (with the consequence, likelihood and alternative that justify leaving it). If the HIGHs exceed my capacity, say by how much.

5. List the ratings you’re least sure of, including any LOW or MEDIUM that a different reading would make HIGH.

Why it works: the scale and capacity arrive before the list, so the list can’t set its own priorities. Step 5 sends your own checking to the borderline calls, where a wrong rating costs most.

TOOL OF THE WEEK

Google Sheets’ AI function, used as a triage desk

Paste each finding into its own row. In the next column, type =AI("Rate this finding HIGH, MEDIUM or LOW. HIGH means …", A2) and fill down. It’s Gemini inside Google Sheets, on eligible Google Workspace and Google AI plans.

Why a sheet rather than a chat: every row gets the same written rule, one at a time, and the ratings land next to the findings, where you can filter, count and disagree with them. A chat sorting 120 items at once hides where it bent the rule.

The limits are real. It fills 350 cells per batch, can’t see the rest of your spreadsheet, and can’t be undone, only regenerated. Google warns it ‘may suggest inaccurate or inappropriate information’. Excel’s equivalent, the COPILOT function, stopped working on 14 September; Microsoft points users to Copilot in Excel.

Verdict: a fast first pass at one written rule over a long list. It rates; you decide. Check every HIGH and a random few of the rest, then paste the ratings as values.

Google Help · AI function · Microsoft Support · COPILOT function

TIP OF THE WEEK

Ask where the evidence is

This won’t catch what the AI missed, and a missing clause can’t be quoted.

So ask the reviewer to point at its evidence for each finding: the text and where it sits or, for something missing, the document and where it looked. Read that before you rate anything.

A pointer is quick to check, and it separates proven findings from unproven ones. Unproven isn’t the same as wrong. Park those for a person rather than binning them, and read first the ones that would be serious if true.

Pro move: for each HIGH, give a fresh chat the whole document and ask it to argue the finding is wrong. A quote alone can mislead: the cap may sit in a schedule. Let the rebuttal guide your reading, not replace it.

YOUR MOVE

Triage one document first

Skip the full audit. Take one contract, or your website’s terms, ask an AI to review it, and run the prompt on what comes back. Sort it all into the three queues before you fix anything.

REPLY WITH ONE LINE

How many findings, and how many made FIX NOW? For example: ‘Supplier contract: 31 findings, 3 to fix now, 19 won’t fix.’ Leave out names and confidential details. I read every reply.

Know someone sitting on an AI audit they haven’t opened? Forward them this.

Disclosure: the original draft used Claude. Anthropic makes Claude and Mythos, both of which appear above.

P.S. The companion, How to triage AI findings, works through a fictional firm’s 287 findings, including the ones its first sort got wrong.

iPROMPT / 158 /