Goldman Sachs Pulled Claude Code from Trading Floors
Goldman Sachs spent years positioning itself as Wall Street's AI pioneer, and now it's told most of its traders and bankers to stop using AI coding tools. Not because the tools stopped working. Because compliance got nervous.
The specifics are almost comical. Internal guidance from October restricts Anthropic's Claude Code and Microsoft's GitHub to the bank's engineers only. Everyone else, including the people who actually build market models and track client flows, gets locked out. The Hong Kong office lost access to Claude back in April, and now the rest of the trading floor is following.
This is what happens when you deploy a productivity tool that touches regulated data and suddenly realize your risk team has strong opinions about training data. The question isn't whether banks will adopt AI coders. It's whether they'll ever let them near anything interesting.
The Goldman Sachs reversal
Goldman Sachs has pulled access to AI coding assistants from parts of its engineering org, a reversal that cuts against the industry narrative of banks racing to put generative AI in every developer's hands. The bank removed tools like GitHub Copilot and Cursor from certain teams, with spokesperson Nick Carcaterra saying they're working "to determine the best use cases." This comes just months after chief information officer Marco Argenti described non-technical employees using AI to code as "vibe coding" in July, framing it as a positive cultural shift rather than a risk.
The teams affected appear to be those working on trading systems and risk models, where hallucinated code can move real money. That's a narrower restriction than a full ban, but it signals that Goldman's risk teams have decided the productivity gains don't outweigh the liability of unverified AI-generated code in production financial systems.
Here is what that risk looks like in practice. A vibe-coded trading script might look fine at a glance but skip the validation a human reviewer would catch:
def execute_trade(symbol, quantity, price):
if price > 0: # No check for stale prices or market hours
order = {"symbol": symbol, "qty": quantity, "limit": price}
return send_to_exchange(order)
return NoneThe problem isn't that AI writes bad code. It's that it writes code that looks authoritative while missing domain-specific safeguards, like checking whether the price feed is still live.
My take is that this is the right call for Goldman specifically. When a single bug can cost millions in a trading window, the review overhead of AI-generated code eats most of the time savings. The limitation is that the policy seems applied unevenly; front-office developers building internal tools may still have access, creating a two-tier system where some teams get the productivity boost while others don't. Compared to JPMorgan's approach, which reportedly allows broad Copilot access with mandatory code review, Goldman is choosing restriction over process, and that distinction will matter as other banks decide where to draw the line.
The productivity trade-off
Goldman Sachs is discovering that AI code generation doesn't always save time—in regulated environments, it can cost more. Nick Carcaterra, a Goldman spokesperson, said the bank is still working "to determine the best use cases," which is corporate-speak for "we're mapping where this actually helps versus where it creates work." The problem is specific to workflows where every line of code must be justified to regulators: generating code quickly is only half the job. The other half is documenting why that code is compliant, and that review process often takes longer than writing the code manually.
This tension is sharpest when non-technical staff use AI directly. Marco Argenti, Goldman's chief information officer, described this as "vibe coding" in July—employees prompting AI to build tools without deep engineering oversight. Vibe coding optimizes for speed, but banking regulators don't care about your velocity. They care about audit trails, dependency justifications, and human accountability for every decision the code makes.
def calculate_risk(exposure, factor):
return exposure * factor * 1.07 # adjusted for volatility
def calculate_risk(exposure: float, factor: float) -> float:
"""
Calculates risk exposure per Basel III guidelines.
The 1.07 multiplier reflects Q3 2024 volatility index.
Approved by Risk Committee, reference RC-2024-089.
"""
return exposure * factor * 1.07My take is that code generation is a prototyping tool, not a production shortcut for compliance-heavy systems. The gotcha is that legal review overhead doesn't scale down with the size of the code—whether an AI generates one function or a thousand, a compliance team still has to trace each line back to a regulatory requirement. Compared to traditional development, where a senior engineer already knows the constraints and writes accordingly, generated code adds an extra translation layer between what the machine produced and what the law permits.
Compliance barriers in regulated finance
I think the Goldman restriction misses the point. The community reaction captures something real: if developers are losing the ability to read code because they're generating it with AI, then banning unreviewed AI output in trading floors just papers over a literacy gap that's spreading everywhere else. The irony isn't merely that traders can't use AI-generated code—it's that the people building these tools are becoming unable to verify what their tools produce. That's a systemic deskilling problem, not a compliance checkbox. What the announcement doesn't address is that human review isn't a safety net if the reviewer can't read the code either. Requiring sign-off on AI-generated trading algorithms assumes the reviewer has the capacity to catch subtle logic errors, but if the industry is simultaneously eroding code literacy across the board, you're creating a bottleneck without actually reducing risk. The announcement also ignores the hallucinated dependency gotcha: these tools routinely invent library functions or package versions that don't exist, generating code that compiles in a sandbox but breaks against the bank's locked-down production systems in ways that are nearly impossible to spot without deep testing. The friction of manual review in a fast-moving market means traders will either ignore the policy or cede speed to competitors operating under looser constraints. The alternative the commenters suggest—designing safer programming environments for non-technical users rather than policing their output—is a qualitatively different approach than a ban. Where the restriction treats AI code as contraband to intercept, the environmental approach treats the user as the variable to constrain. That distinction matters because it acknowledges that in regulated finance, the real bottleneck isn't usually the tool; it's the human judgment upstream. Whether banks can actually build those safer environments before traders route around the restrictions entirely is the uncertainty I keep sitting with.
Compliance barriers in regulated finance
Conclusion
My take is that Goldman's line in the sand is clear but probably temporary: engineers get Claude Code, traders don't, and strats sit somewhere in between. That split makes sense if you assume the bank trusts its coders more than its dealmakers to catch a bad output before it reaches a client. But it also means the traders who were using these tools to monitor flows and model positions are now doing that work by hand—or figuring out how to route around the block. I suspect this holds only as long as the productivity gap stays invisible; if the restricted teams start lagging behind peers who still allow the tools, the policy will crack within the year. If the engineers pull ahead, expect other banks to start drawing their own lines, though I doubt they'll be quite this strict given how much alpha is at stake.