By ByteBot
Goldman Sachs reversed course last week, quietly pulling Claude Code and GitHub Copilot access from its traders and investment bankers — tools its own CIO had publicly championed just four months earlier. Internal guidelines updated in October now limit both products to Goldman’s 12,000 engineers and a narrow class of quantitative specialists called “strats,” Bloomberg reported on November 2. The switch is a clear signal that enterprise AI adoption is entering a harder, more regulated phase.
Four Months from Praise to Ban
In July 2026, Goldman CIO Marco Argenti was publicly championing “vibe coding” — the workflow where a non-technical employee uses AI to prototype a working solution and hands it off to an engineer. Argenti described Goldman’s non-engineers shipping quick tools and passing their creations to one of the firm’s 12,000 engineers for enhancement. It sounded like a productivity win. It was also, apparently, a compliance problem waiting to happen.
The October policy reversal was specific: traders and bankers, who had used Claude Code for tasks including market simulation, client activity tracking, and report creation, are now cut off. Engineers retain full access. The bank’s spokesperson framed it carefully: “After a period of experimentation where we assess a variety of factors including productivity and risk management, we put them in the hands of those who are best suited to leverage them for the long term.” In other words, the experiment ran its course.
Why Lawyers and Regulators Forced the Issue
The core problem is material non-public information, or MNPI — financial data that has not been disclosed publicly and could influence investment decisions. When a trader feeds client activity data into a general-purpose AI coding tool to build a monitoring script, that data enters systems not designed for financial compliance environments. No audit trail. No data barrier. No guarantee it avoids a training pipeline somewhere.
A Skadden legal analysis from July 2026 made the exposure explicit: AI tools that access MNPI can trigger Section 204A scrutiny “even absent any trade.” The bank does not need to actually trade on leaked data for regulators to have a case — the potential for misuse is enough. Claude Code and GitHub Copilot are powerful general-purpose tools. They are not built to enforce information barriers between a bank’s trading desk and its investment banking division.
Related: Claude Code’s Game-Clone Rule Is Blocking Developers
The Real Strategy: Centralize, Don’t Kill
Goldman is not retreating from AI. The bank is simultaneously rolling out its GS AI Assistant to all ~46,000 employees — a chat interface built on Goldman’s own platform that queries models from OpenAI, Google, and Anthropic without client or firm data leaving Goldman’s controlled environment. The message is “our AI, on our terms,” not “no AI.”
The distinction matters. Claude Code is a general-purpose coding agent that reads files, accesses repositories, and executes code. The GS AI Assistant is a controlled chat window with managed data flows. One creates compliance exposure; the other is built to avoid it. Developers building AI tools for regulated enterprise clients should take note: a chat interface with a strong enterprise data story gets deployed to everyone. A general-purpose coding agent gets restricted to the people whose work already lives inside proper governance structures.
Wall Street Is Moving in the Same Direction
Goldman’s move is not an outlier. JPMorgan CEO Jamie Dimon blocked outside AI agents from customer accounts in October, saying on the bank’s Q3 earnings call: “You don’t want rogue agents, and it could be thousands of them.” JPMorgan’s ban covers any third-party agent logging into a customer account — outside agents can see balances read-only via approved connectors, but cannot initiate transactions. Two of the largest financial institutions in the world tightening AI governance in the same month is a pattern, not a coincidence.
The practical consequence for developers: shadow AI is the risk that outlasts these restrictions. Enterprise security data shows two in three office workers use AI tools their company explicitly prohibits. Goldman cutting off traders does not guarantee those traders stop using Claude on personal devices. It just moves liability. The deeper governance challenge remains unsolved.
Key Takeaways
- Goldman Sachs restricted Claude Code and GitHub Copilot to engineers only in October 2026, reversing a permissive policy its own CIO had endorsed four months earlier
- The core risk: general-purpose AI coding tools have no concept of financial information barriers — MNPI exposure via AI is a documented regulatory liability under Section 204A
- Goldman is not abandoning AI — it is centralizing it via the GS AI Assistant, which reaches all 46,000 employees with controlled data flows and no external data exposure
- JPMorgan blocked outside AI agents from customer accounts in the same month; this is a Wall Street pattern, not a one-off
- Developers building AI tools for regulated enterprise clients need data isolation, audit logs, and no-training guarantees — a controlled interface beats a general-purpose coding agent in every compliance conversation
