Goldman Sachs is pulling Claude Code from its bankers and traders
TL;DR Highlight
Goldman limits coding agents to engineers, cutting off traders and bankers
Who Should Read
A developer in charge of AI adoption who is deciding whether to give coding agents like Claude Code to non-engineering staff
Core Mechanics
- Coding agents are now engineers-only
- Internal guidance updated in October restricts Claude Code and Microsoft's GitHub tools to the bank's engineers.
- Strats, who work across trading, quant research and software engineering, still have access.
- The in-house AI assistant, which uses models from several companies, remains available firm-wide.
- Client-flow monitoring work got cut
- Traders had used the tools to monitor client trading flows, model market moves and positions, and make written and graphic material.
- Some traders are frustrated, according to Bloomberg.
- The review looked at productivity and risk concerns.
- In July it was praised
- CIO Marco Argenti promoted "vibe coding" by non-technical staff in July.
- Traders and bankers built tools and passed them to about 12,000 engineers to improve.
- Agent code reaches work without review
- Claude Code reads files, writes programs and runs them, typically with the user's own access.
- Engineer code goes through review, testing and deployment controls, but a trader's script can reach daily use without them.
- Banks must keep information barriers between groups, and agent-built tools weren't designed with those in mind.
- Hong Kong restriction was location-based
- In April Goldman removed Claude from its internal AI platform for Hong Kong bankers.
- An Anthropic spokesperson said Claude had never been officially supported in Hong Kong.
- The new restriction is based on role, not location.
- Other banks go different ways
- Barclays said in October it expects half its developers to be using Claude Code by year end, then named developers among 5,000 job cuts.
- JPMorgan and Schwab are blocking outside agents from customer accounts.
Community Reactions
- Isolation is the core issue, one view says
- One commenter argued that running semi-unattended agents on finance staff's main machines mixes client and trade data, email, internet and internal network access.
- They said one small mistake or a prompt injection could cause a major leak.
- A commenter guessed it was an operational loss
- One commenter noted that only traders can send orders and book client trades.
- They argued an agent running under a trader's account with minimal review would eventually enter a bad order.
- Claude access clawed back over billing, one commenter says
- One commenter said their org is pulling back Claude access because of chronic billing overages.
- They said they're moving to Gemini, which has flat billing and throttles access to higher models.
- Excel macros became Claude artifacts, one comment says
- A commenter said the old obscure Excel macros are now Claude artifacts, with nothing improved.
- They said the pullbacks they've seen came from compliance or security checkboxes.
- Managed environments suggested as the alternative
- One commenter said the engineering team should design a programming environment where bankers can't hurt themselves.
- Another listed containers, egress filters, human in the loop and per-agent MCP controls as the safety side.
- One commenter said they saw a pattern where security says no, it's escalated and allowed, then about 1% of the time the model leaks data and it's locked down again.
- A note on sourcing
- One commenter pointed out the original source is Bloomberg and State of AI is a rewrite site.
How to Apply
- Tabulate agent permissions today
- List who in your company uses coding agents like Claude Code or Copilot, and their roles.
- In the same table, note the data, email, internal network and production accounts each can reach.
- Name an owning engineer for agent-built code
- Before a non-engineer's agent-built tool touches production data, name an engineer who owns it.
- Apply information barriers, data entitlements and software approval rules to agent-written code as well.
- Record what people used a tool for before pulling it
- Interview users about what they used the tool for before you revoke access.
- Hand the findings to the engineering team as a backlog for a replacement tool.
Try It
copy & run
# Prompt to paste into Claude or ChatGPT (a simplified checklist version of the article's advice)
You are a security reviewer in a regulated financial environment. Below is a description of a tool that a non-engineer at our company built with a coding agent.
{{Tool description: what it does, data it uses, runtime environment, users}}
Answer in a table:
1. Which engineer should own this tool
2. Where it may violate information barriers, data entitlements or software approval rules
3. The worst-case scenario if it is used daily without code review and testing
4. Three controls needed before it touches production data
Next step: re-evaluate the same tool assuming it only runs in a sandbox (an isolated environment).Terminology
vibe codingBuilding tools by telling an AI what you want without reading or writing the code yourself. If it runs, it ships, so nobody may understand the internals.
Information barrierA regulatory wall between bankers working on deals and traders who could profit from that knowledge. Think of it as an internal firewall between teams.
StratsGoldman staff who work across trading, quantitative research and software engineering.
lethal trifectaA concept mentioned in the comments: an agent that handles sensitive data, external communication and untrusted input at once. With all three together, a leak becomes easy.
Related Papers
How I Fight AI Brain Fry
Keeping tickets in git and deciding in one inbox tamed my 20-thread agent chaos
Agent memory needs its OpenTelemetry moment
Agent memory formats are fragmented, so this post proposes an OpenTelemetry-style shared spec.
Goodbye Claude, hello Pi
Frequent system prompt changes and token overhead pushed one dev from Claude Code to Pi.
The Components of Agent Memory
Giving Claude a memory folder plus dreaming lifted document QA scores from 13% to 48%
ChatGPT silently passes data between connectors and the bounty wants an ID card
With two connectors enabled, a follow-up tool call silently switched connectors
Claude Code sends your email address to websites
Claude Code put users' emails in curl User-Agent headers, prompting spam complaints and a built-in blocking mod
Launch HN: Rivet (YC W23) – Scale and Orchestrate Agents on S3
Running each agent as an Actor gave 4.99 ms p99 cold starts and 72 KB RAM per instance.
Show HN: Stroq – a local audit of what your coding agent did and why
Stroq finds leaked keys in agent sessions and traces risky commands to their source before they run