Goldman Sachs Restricts AI Coding Agents for Non-Engineering Staff

Goldman Sachs Limits AI Coding Agents to Engineering Staff

Goldman Sachs has updated its internal policies to restrict the use of third-party AI coding agents, specifically Anthropic's Claude Code and Microsoft's GitHub, to its engineering teams. While the bank previously encouraged non-technical staff to build tools using AI, the new guidance effectively removes these capabilities from traders and bankers. This shift follows a firm-wide review of productivity, security, and operational risk, though the bank continues to maintain its own internal AI assistant for broader use across the firm.

Security and Compliance Risks in Financial Environments

The primary driver for this restriction is the inherent risk of running autonomous coding agents on workstations that handle sensitive client, trade, and proprietary financial data. Unlike software engineers, who typically follow established protocols for code review, testing, and deployment, non-technical staff using these tools often bypass these safeguards.

Industry observers and internal stakeholders have highlighted several critical concerns:

• Operational Integrity: Coding agents can execute programs with the same permissions as the user. If a trader uses an agent to automate market monitoring or position modeling, an unreviewed script could inadvertently execute erroneous trades or enter bad orders.
• Information Barriers: Financial institutions are legally required to maintain strict information barriers between departments. AI agents, which may not be designed with these regulatory constraints in mind, risk leaking confidential data across internal silos.
• Lack of Oversight: There is a significant risk that code generated by AI and deployed by non-engineers cannot be audited or understood by the user. As one commenter noted, "You cannot have semi-unattended agents running on the same workstations that have access to client/trade/prop information... a major leak is just one small mistake or prompt injection away."

The Shift from "Vibe Coding" to Controlled Governance

As recently as July, Goldman Sachs leadership, including CIO Marco Argenti, publicly praised the use of AI by non-technical employees to build initial prototypes. This "vibe coding" approach allowed staff to address immediate problems without waiting for engineering resources. However, the transition from experimental prototypes to production-level tools created significant governance challenges.

Critics of the previous open-access policy point out that the lack of rigorous oversight led to "thousands of Claude artifacts" performing critical business functions without the necessary compliance checks. The bank's decision to pull back suggests a realization that the risks of unmanaged AI-generated code—ranging from regulatory non-compliance to potential financial loss—outweigh the immediate productivity gains for non-technical staff.

Industry Context and Future Outlook

The restriction at Goldman Sachs highlights a broader tension in the financial sector regarding AI adoption. While some institutions like Barclays are expanding the use of AI agents to optimize engineering workflows, others are tightening controls to mitigate liability.

• Cost and Efficiency: Beyond security, some organizations are experiencing significant cost pressures due to token-based billing models for AI agents.
• Regulatory Pressure: Financial firms face intense scrutiny regarding data privacy and the auditability of automated processes. As one industry participant noted, "The very highly paid team used AI to inaccurately perform the task... the resulting errors could have resulted in jail time for the decision makers."

Goldman Sachs remains a lead underwriter for Anthropic's upcoming IPO, underscoring that the restriction is a localized operational decision rather than a rejection of the technology itself. The bank continues to work with Anthropic to develop secure, back-office AI agents that are managed and deployed by professional engineering teams, signaling a move toward a more centralized, controlled model for AI integration.