Goldman Sachs has cut off access to Claude Code, Anthropic’s command-line coding agent, and to GitHub, for most of its traders and investment bankers. The news, first reported by Bloomberg on November 2, 2026, stems from internal guidance updated in October: after several months of broader access across non-technical teams, the bank is now limiting these tools to its roughly 12,000 engineers and to its “strats,” hybrid staff who combine software engineering, quantitative research, and trading.
What the new guidance changes
Until now, traders and bankers had been using Claude Code and GitHub to monitor client order flow, model market moves and positions, and produce written and visual material for sales teams. The October guidance ends that broader use: those roles lose direct access to both tools, which are now reserved for staff whose main job is building software.
Who keeps access, who loses it
| Role | Before the guidance | Since October 2026 |
|---|---|---|
| Software engineers | Full access | Full access |
| “Strats” (engineering + quant + trading) | Full access | Full access |
| Traders | Access to Claude Code and GitHub | Access revoked |
| Investment bankers | Access to Claude Code and GitHub | Access revoked |
The reasons the bank gave
A Goldman Sachs spokesperson, Nick Carcaterra, framed the decision as a trade-off between productivity and risk, saying the tools now sit “in the hands of those who are best suited to leverage them for the long term.” The statement stays vague on the specific incidents that triggered the review, but it confirms that the broader rollout decided earlier this year was judged too wide given how the tools were actually being used outside technical teams.
Goldman Sachs has put access to Claude Code and GitHub back in the hands of the teams whose main job is building software.
A reversal after months of openness
The change breaks with the stance taken in July by CIO Marco Argenti, who at the time championed “vibe coding” by non-technical staff as a productivity lever. Earlier in the year, Goldman Sachs had already restricted Claude use for its Hong Kong staff, over concerns about confidential data leaving the firm. The bank has also built its own internal assistant on top of models from OpenAI, Anthropic, and Alphabet, which lets it keep tighter control over what non-technical staff can actually touch.
Worth noting: the Hong Kong restriction, driven by data confidentiality, and the November one, driven by productivity and risk, are not answering the same concern. Both still converge on the same operational outcome: fewer non-technical roles with direct access to a coding agent.
What it says about enterprise practice
The episode joins a string of recent stories about governing coding agents in production. Mail Studio has previously covered how Claude Code’s “Don’t Ask Again” setting leaked over 1,300 secrets on GitHub, and how the tool exposed account email addresses through its User-Agent header. Taken together, these episodes trace a pattern: large companies are narrowing the scope of coding-agent access as they discover blind spots in rollouts that moved faster than their security planning.
Key takeaways
Goldman Sachs now limits Claude Code and GitHub to engineers and “strats,” after letting traders and bankers use them for months. The decision illustrates a broader trend among major financial institutions: widening access to coding agents is easy; narrowing it back after the fact means owning a governance call in public.
This kind of reversal should not come as a surprise: handing broad access to a coding agent to people who cannot read what it produces means accepting a risk nobody has priced yet. It is better to open that access gradually, with clear guardrails, than to open it wide and then shut it down under the pressure of an incident or an audit — Simon Janvier.
Further reading: Goldman restricts Claude Code, GitHub for traders and bankers (Dealroom, based on Bloomberg’s reporting).
