Goldman pulls Claude Code from bankers; 5 of 6 controls ship disabled

Goldman Sachs has cut most of its traders and bankers off Anthropic's Claude Code and Microsoft's GitHub coding tools and kept them for engineers, under internal guidance updated in October, Bloomberg reported on November 2. A Goldman spokesperson, Nick Carcaterra, told Bloomberg the bank weighed "a variety of factors including productivity and risk management" and is limiting the tools to the people "who are best suited to leverage them for the long term," according to The Decoder's account of the report.

Our take: this is not Goldman backing away from AI. It is a bank drawing a line around one thing, an agent that runs on an employee's laptop with that employee's logins, and the vendors' own documentation suggests why. Of the six controls Claude Code gives an IT team on the device that we list below, one is on by default; its sandbox is off until someone turns it on, and on native Windows there is none. So the restriction says less about whether bankers should build software than about who has done the setup work. Until the agent runs somewhere the bank controls, with credentials scoped to the task and logs the compliance team can read, a bank will hand it only to the people whose job is to own what it does.

That answers the question most readers under the X posts were asking: why take a coding agent away from a trader, and how would a company let non-engineers use one safely? The short version is that the risk sits less in the model than in the access the agent inherits, and the controls that narrow that access exist today but ship switched off.

What the industry is saying

The Bloomberg story reached most of the industry through X overnight. Amjad Masad, chief executive of Replit, which sells a cloud-hosted coding agent and so has a commercial stake in the argument, quoted a post about it from the newsletter Exec Sum, which called the move a ban on AI tools, with an 11-word verdict at 04:58 UTC on November 3.

Masad did not name other firms, and we found no other bank's coding-agent policy on the public record by 13:45 UTC on November 3. About 90 minutes after his first post he framed the problem as one of place rather than of model, linking a security advisory that Replit's chief technology officer, Luis Héctor Chávez, had posted on X.

The replies under that post, 159 by the X API's count when we read them, split three ways: bans push agents onto personal laptops, moving the agent to a managed cloud fixes it, or neither matters without scoped credentials. Adam Dudley, chief of staff and vice president at the vulnerability management company Nucleus Security, made the case against treating hosting as the cure.

Beto Dias, who leads AI building at ADP Ventures, put the most common objection to the ban itself, and closed on the question this piece tries to answer.

Is it a ban, or a reshuffle of access?

A reshuffle, on the evidence. Bloomberg's report describes access narrowed to engineers, not withdrawn from the firm, and everything Goldman has said in public this year points the same way. In February the bank told CNBC it had spent about six months working with embedded Anthropic engineers on autonomous agents for trade accounting and client onboarding, and its chief information officer, Marco Argenti, said "Claude is really good at coding". In May, Fortune described Argenti measuring AI by how quickly his engineering teams move from an idea to executing on it, with 12,000 engineers under him. On October 28 Amir Efrati, executive editor of The Information, posted this on where the bank's AI money goes.

What changed is the plan for everyone else. Bloomberg reported that traders and bankers had used the tools for months to monitor trading flows and create content, and that in July Argenti had praised non-engineers building with AI, the idea being that a trader prototypes and an engineer takes the result to production. The October guidance ends that route for now, and Bloomberg reported that some staff were frustrated.

What can a bank's IT team switch on today?

We read each vendor's own documentation on November 3 and listed the controls that matter when an agent runs on a staff machine. The pattern is the same for both products: the controls exist, they are mostly an administrator's job, and the defaults favour the person at the keyboard.

Source: SaasBuzz analysis of Anthropic's Claude Code documentation (sandboxing, settings, permissions, monitoring) and GitHub's Copilot documentation (policies, audit log, content exclusion, agent firewall), read November 3, 2026.

Three lines in those pages carry most of the weight for a bank. Anthropic's sandboxing page says the sandbox is "off by default," that it runs on macOS, Linux and WSL2, and that "on native Windows, Claude Code runs commands unsandboxed." It also says that by default, if the sandbox cannot start, Claude Code runs commands without it, unless an administrator sets it to fail closed. Even when it runs, reads stay broad by default and can reach credential files such as a user's SSH keys and AWS credentials, the page says. The protections are real: managed settings sit above every user setting, so "nothing in your own settings files or --settings overrides a managed key," and a policy can switch off the mode that skips permission prompts. But each one is a decision someone has to make and deploy.

GitHub's audit log, for its part, "does not include client session data, such as the prompts a user sends to Copilot locally," and keeps 180 days of events. Its content exclusion, which hides chosen files from Copilot, "is currently not supported in Edit and Agent modes" in VS Code and other editors. Its firewall applies only where the cloud coding agent runs, and GitHub warns that it is not a complete security answer on its own. A compliance team that wants a record of what an agent was asked to do on a desk machine has to build part of it.

Replit's answer, set out in a post by Chávez on October 28, is to keep the agent off the laptop altogether: connector credentials held outside the agent's context by a broker that "authorizes every single request," each execution environment in its own microVM, and audit logs that can be streamed to a security team's tools. It is a vendor describing its own product, and Dudley's point applies to it as much as to anyone: a cloud box is only as safe as the keys put in it.

Doesn't a ban just push agents onto personal laptops?

This is the strongest objection, and it deserves a straight answer: yes, some of the demand will go there, and banks know exactly what that costs. On September 27, 2022, the SEC charged 16 Wall Street firms over staff using personal devices and apps for business messages, with penalties of more than $1.1 billion; Goldman's share was $125 million, at most 11.4% of the total by our arithmetic. "The firms did not maintain or preserve the substantial majority of these off-channel communications," the SEC said.

That history cuts both ways, and we think it favours Goldman. It proves that bans leak, which is the replies' point. It also explains why a bank would rather pull a tool than run it half-configured: a trader's agent writing code against market data with no log the bank keeps looks to a compliance officer a lot like a WhatsApp chat about a trade. The ban does not solve the problem. It buys the time to build the managed version, and the record says banks do then build it.

Have banks done this before?

Yes, with chatbots, 1,347 days earlier. On February 24, 2023, Bloomberg reported that Bank of America, Citigroup, Deutsche Bank, Goldman Sachs and Wells Fargo had recently banned staff from using ChatGPT. Bank of America's notice, it said, came in a routine reminder about unauthorized apps that also covered WhatsApp, the same category of risk the SEC had fined five months earlier.

By 2026, at Goldman at least, the ban had turned into an internal platform. When Goldman removed Claude for its Hong Kong bankers in April, Reuters reported that staff there had been using it through an internal AI platform on which other models remained available. That cut had a different cause, which the Financial Times reported as a strict reading of the bank's contract with Anthropic; Anthropic told the FT its models had never been officially supported in Hong Kong. But it shows the shape: the bank decides which model runs, where, for whom, inside its own walls. Coding agents are now going through the same door, 3.7 years after chatbots did.

What it means for people who build, buy and invest in software

For vendors selling coding agents to regulated buyers, the admin console is the product. A bank will not hand a tool whose sandbox is off by default and absent on native Windows, or whose audit trail does not see the prompts typed on the device, to a trading floor of non-engineers. The vendor that ships a desk-ready default, sandboxed and logged out of the box, with credentials brokered per task, makes the security team's yes cheap. On that measure the cloud-hosted agents, Replit's and GitHub's own coding agent, start closer to what a bank wants than any agent on a laptop, and Claude Code on the desktop leaves the most for an administrator to set.

For buyers outside finance, the Goldman line is a usable template: give coding agents to the people who will own the code in production, and widen access only as fast as the controls in the table above are switched on and checked. The supply-chain risk is not hypothetical; six attacks this year reached developers through AI coding tools via extension and package stores.

For investors, there is a conflict worth stating. Anthropic's Form S-1 names Goldman Sachs and Morgan Stanley as the representatives of the underwriters of its initial public offering, and they decide early releases from the lock-up. The bank leading Anthropic's listing has just limited Anthropic's coding agent inside its own walls. We read that as evidence that the restriction is about deployment, not about the model: Goldman is not shy of Claude, it is wary of laptops.

What would change our view

We would be wrong if Goldman's guidance turns out to cover Claude inside its internal platform as well as the desktop tools, or if it is followed by the bank cutting its use of coding agents among engineers. Neither is in Bloomberg's report. Watch for three things: whether other banks put their own coding-agent rules on record, whether Anthropic and GitHub change their defaults for enterprise accounts, and whether Goldman reopens access to non-engineers through a managed environment, which is what the 2023 precedent predicts.

How we did this

The table lists the controls each vendor documents for agents that act on a user's machine or on the vendor's cloud, as their pages read on November 3, 2026, and counts as "on by default" only what an employee gets if IT configures nothing. Of the six Claude Code device controls we list (sandbox, sandbox failing closed, prompts before commands, the lock on bypass mode, managed settings, telemetry), one, prompting before shell commands and edits, is on without an administrator. We did not test the products ourselves. The facts about Goldman's guidance come from Bloomberg's report, as relayed by The Decoder, and from Goldman's statement in it; Goldman had not commented beyond that statement by the time of writing.