Goldman Sachs has reportedly restricted Anthropic’s Claude Code and Microsoft’s GitHub to engineers—and exempted “strats”—after an October 2026 policy update reviewed productivity and risk, according to Bloomberg News coverage summarized by PYMNTS on November 2, 2026. Most traders and bankers who had been using the coding agents for client-flow monitoring, market modeling and deck material no longer have access. The bank’s spokesperson framed the move as steering powerful tools to staff best equipped to use them after experimentation—not as abandoning AI. If you run Claude Code or similar agents anywhere near regulated data, the story is a concrete example of who may prompt, run, and own code when an agent can read files and execute commands with the user’s identity.
| Question | Short answer |
|---|---|
| Am I affected? | Only if you roll out coding agents outside engineering on market or client data |
| Is there a fix? | No patch—governance: role limits, review paths, logging, named engineer owners |
| Does data leave my machine? | Claude Code can send context to the model provider per Anthropic’s terms; bank risk here is local execution and data entitlements |
| Is this an Anthropic vulnerability? | No disclosed CVE; this is enterprise access policy |
| What should I do this week? | Map who has agents today; require engineering sign-off before production use |
Bloomberg Law published the same story on November 2, 2026 under capital markets news. The full text is subscriber-only, but the public lede confirms Goldman “banned most” staff from advanced AI coding tools after a risk and productivity review, and that Claude Code and GitHub moved to engineers only. This post stays with details that appear consistently across Bloomberg-derived summaries.
What changed and what Goldman said
For months, Goldman allowed bankers to use Claude Code and GitHub on the job, per Bloomberg reporting relayed by PYMNTS. Internal guidance updated in October 2026 limits those products to engineers. Strats—employees whose work spans trading, quantitative research and software engineering—still have access, according to the same reporting.
Goldman spokesperson Nick Carcaterra told Bloomberg, as quoted by PYMNTS:
“We make certain AI tools available to our people to determine the best use cases across different parts of the firm. After a period of experimentation where we assess a variety of factors including productivity and risk management, we put them in the hands of those who are best suited to leverage them for the long term.”
That quote matters for security teams: the bank explicitly weighed risk management beside productivity when narrowing the audience—not model quality alone.
Traders cited in the reporting were frustrated because they had used the agents to track client trading activity, simulate market and position changes, and draft text and visuals. Those tasks sit on the same machines and entitlements as everyday banking work. A flow monitor that runs every morning is software, whether a strat wrote it in Python or a banker generated it with Claude Code.
The policy does not appear to shut off Goldman’s broader AI stack. Reporting notes an in-house assistant that draws on models from OpenAI, Anthropic and Alphabet, still available more widely. The restriction targets third-party coding agents that write and run code autonomously—the same class of tools covered in our enterprise AI coding agent rollout checklist.
Timeline: from “vibe coding” praise to engineer-only agents
Three dates anchor the policy arc:
- July 2026 — Chief Information Officer Marco Argenti praised “vibe coding” by non-technical staff in Bloomberg interviews summarized by PYMNTS. Traders and bankers built first versions with AI and handed them to one of about 12,000 engineers to refine.
- April 2026 (Hong Kong) — Reuters on April 29, 2026 summarized Financial Times reporting that Goldman removed Claude for Hong Kong bankers after consulting Anthropic and reading the contract strictly. ChatGPT and Gemini stayed available. Anthropic said Claude had never been officially supported in Hong Kong.
- October 2026 — Firm-wide guidance limits Claude Code and GitHub by role, with engineers and strats retained.
The Hong Kong step was jurisdiction and contract driven. The October step is who may run code-writing agents at all. Together they show Goldman tightening two different knobs: where Anthropic products may run, and which job functions may use agentic coding tools.
Goldman is also a lead underwriter on Anthropic’s planned IPO, per widespread capital-markets reporting in late October 2026—a commercial tie that does not change the security mechanics but explains why desk-level frustration drew press attention.
Why a coding agent is a different risk on a trading desk
Claude Code is not a chat summary tool. It reads repository and host files, proposes tool use, and runs commands with permissions tied to the interactive user. On a developer laptop that usually means code review, CI, and branch protections before anything reaches production. On a trading desk, a script that “just watches client flows” can still:
- Read files and credentials the user can read, including shared drives and exported extracts.
- Execute network calls from the host, including to internal APIs not exposed to normal review.
- Persist logic nobody diffed, if the author does not open a pull request.
Banks must maintain information barriers between groups—classic examples include separating investment banking from trading around material non-public information. Software built outside the engineering SDLC was not designed around those controls. Engineers can only review what gets sent to them; reporting on Goldman noted that traders passed prototypes downstream, but daily-use desk tools may never enter that queue.
This parallels themes in Meta’s Project OT pullback, where internal metrics linked unchecked agent autonomy to a jump in major incidents—not because the model failed, but because volume and autonomy outran review. Goldman’s reported response is narrower: shrink the population that may run agents, not ban merges.
Goldman partner Chris Churchman warned in an August 24, 2026 CNBC interview that delegating reasoning to models risks “cognitive atrophy” among junior staff—a human-capital angle adjacent to desk-built agents. For security readers, the immediate lesson is simpler: agent output is still code, subject to entitlements and barriers, even when the author cannot read every line.
What other banks are doing with agents
Goldman’s move sits in a wider banking agent perimeter trend:
- JPMorgan CEO Jamie Dimon warned of “rogue agents” on an earnings call, and reporting describes blocking outside agents from customer accounts—details in our US banks blocking credential-based agent logins post.
- Barclays publicity in October 2026 pointed half its developers toward Claude Code by year end while also announcing job cuts—same tool, different bet: engineers only, headcount math aside.
None of that makes Goldman’s policy universal law. It does show regulated employers converging on separation: chat and read-only copilots for many roles; code-executing agents for staff trained to review output.
What developers are saying
Hacker News discussion on item 50415628 mixed sympathy for desk users with engineering fatigue:
- cloudednine—an engineer who received trader-built tools—said “improved” was generous; many prototypes needed complete overhauls or landed in backlog.
- aurareturn argued restricting agents to engineers matches who can catch model mistakes—not a verdict that AI fails.
- CharlieDigital noted that even engineers struggle to read all agent output, so “move fast” cultures collide with review expectations.
- Ericson2314 suggested designing safer programming environments for non-engineers instead of only revoking access—a design problem banks have not publicly solved.
Treat these as practitioner color, not confirmed facts about Goldman’s internal process.
What this means if you run AI coding agents
You do not need Goldman’s balance sheet for the pattern to apply. Any team that gave Claude Code, Codex, or Cursor agent mode to analysts, ops staff, or revenue teams should run this checklist:
- Inventory who has agents on machines that touch customer, trading, or PHI-adjacent data—not just engineering headcount.
- Require a named engineer owner before desk-built scripts run on a schedule or touch shared databases—matching the spirit of Carcaterra’s “best suited” language without waiting for frustration to spike.
- Route production changes through the same gates as human-written code: branch protections, peer review, secrets scanning. Agent authorship does not bypass SOX, PCI, or internal barrier rules.
- Log tool proposals, not only merges. Claude Code PreToolUse hooks fire before execution; pair them with local retention if you need evidence after an incident. Our South Korea bank ARTEX analysis shows how exposed session files can reveal what an agent touched.
- Separate “chat about data” from “run code on data.” Banks are already blocking credential-sharing agents on consumer accounts; extend that split internally for code execution on entitlements-heavy desktops.
Version checks: run claude --version and your package manager’s list command after IT changes approved builds—Goldman’s story is policy, but stale CLIs still miss hook fixes covered elsewhere on this blog.
What Beam can and cannot do here
Beam is a local observability and hook layer for coding agents on developer machines: it can capture PreToolUse proposals, redact known secret shapes before storage, and scan SKILL.md and MCP configs with heuristic patterns. Workspace enforce mode can deny matching tool calls on Claude Code and Codex when cached policy is fresh—it is fail-open when policy is missing or expired, and it is not a kernel sandbox.
That helps an engineering team prove what an agent attempted on a laptop and block a subset of risky commands. It does not replace bank-grade information barrier enforcement, SDLC gates, or entitlement reviews for trader-built tools that never touched git. In a Goldman-like model—agents limited to engineers—Beam fits the engineering cohort’s workstations first; desk machines without agents reduce agent risk by removal, not by scanning.
See how Agent Baseline’s secure software factory thinks about putting limits outside the agent for org-scale factories; Beam covers a slice of that picture on-device.
Related reading
- Meta Project OT: unchecked coding agents and security incidents
- Enterprise AI coding agent rollout checklist
- US banks block AI agents that use customer logins
- South Korea bank hack: ARTEX and Claude Code sessions
- Agent Baseline secure software factory architecture
Frequently asked questions
Did Goldman Sachs ban Claude Code entirely?
No. Reporting says Goldman restricted Claude Code and GitHub to engineers and strats while keeping broader AI assistants available. The change targets autonomous coding tools, not all model use.
Who still has access to Claude Code at Goldman?
Engineers and strats (quant/trading/engineering hybrids), per Bloomberg-derived reporting. Most traders and bankers do not.
What were traders using Claude Code for?
Monitoring client flows, market and position modeling, and written or visual materials, according to sources cited in Bloomberg reporting.
How does this relate to Goldman’s Hong Kong Claude restriction in April?
April’s change removed Claude for Hong Kong bankers on contract grounds, per Reuters summarizing the FT. October’s change is role-based and includes Claude Code specifically.
Does this mean Claude Code is unsafe on a trading desk?
The issue is governance: unreviewed executable logic on entitlement-rich hosts. Fix the process; do not assume the model vendor ships bank SDLC controls.
What should teams do before expanding Claude Code beyond engineering?
Assign engineer ownership, enforce review paths, instrument PreToolUse, and align with barrier rules—start with the rollout checklist.
Reporting details and vendor policies cited here were accurate as of November 8, 2026.