Goldman Sachs limits AI coding tools for bankers and traders

Goldman Sachs has reportedly restricted bankers and traders from using AI coding tools, including Anthropic's Claude Code and Microsoft's GitHub coding tools. Bloomberg reported it. One group is exempt: quantitative staff known as strats. A Goldman spokesperson said the bank weighs productivity gains against possible risks when deciding who keeps access.

What the tools do and why they worry banks

Coding agents are AI helpers that can write software and take actions on a computer with little supervision. When they run on an employee's laptop, they can reach whatever that laptop can reach. The concerns named in the story are exposed logins and keys, hidden malicious instructions, and compromised software parts, which is the kind of attack known as a supply chain attack.

Masad, who shared a security advisory from Replit, said the crackdown is widespread in finance and pointed to supply chain attacks as a driver. He gave no examples of incidents behind Goldman's move.

Limiting users may not be enough

The story argues that restricting these tools to engineers does not fully solve the problem. Even experienced developers can run agents that follow malicious instructions or pull in compromised software. The material points to a few examples:

• A compromised Claude Code extension was distributed through the Cursor marketplace.
• Intruders hijacked about 1,900 GitHub accounts, then moved against some 30,000 repositories.
• One research team found that removing a single line from Claude Code's instructions made its out-of-scope actions climb.

What Replit recommends

Replit's advisory was written by its chief technology officer, Luis Héctor Chávez, and engineering lead Manish Mehta. It says agents should run in company-controlled cloud environments, not on employee devices. Those environments should give each task only the access it needs. Logins, activity records and approvals should be managed separately.

The thinking is that companies should control what agents can do, not only who gets to use them. The story also notes that letting non-developers build software has been a big selling point of these tools. That is harder to justify when agents can touch sensitive company systems.

What is still unknown

Nobody has shown how many organizations have introduced similar limits. Masad called them widespread but offered no public evidence. Whether banks adopt the cloud-based approach also remains to be seen. The New Stack has asked Replit for more comment.