Goldman Sachs Is Pulling Claude Code from Its Bankers and Traders
902 points
• 4 days ago
• Article
Link
Goldman Sachs 最近出台了新的内部指导方针，限制其工程员工使用 Anthropic 的 Claude Code 和 Microsoft 的 GitHub 等 AI 编码工具。这一决定标志着该行此前思路的重大转向：过去，该银行鼓励交易员和银行家使用这些智能代理来开发自定义软件解决方案。尽管该行首席信息官在 7 月份还曾称赞这些"vibe coding"尝试，但新政策实际上将这类强大工具从非技术岗位收了回来，把使用范围限定在工程部门约 1.2 万名员工之内。
推动这一限制的主要原因似乎包括生产力考量、与基于 Token 计费相关的费用成本，更关键的是风险管理。与工程师开发的软件通常要经过严格的审查、测试和部署控制不同，交易员所做的工具往往会绕开这些安全环节。由于这些编码代理能够以与用户相同的权限读取文件、编写程序并执行代码，银行在信息隔离与数据完整性方面面临显著风险。此外，让非技术员工部署自己并不完全理解的代码，本身就存在隐患，可能导致交易台出现重大错误，甚至造成财务损失。
在 Goldman Sachs 还是 Anthropic 即将启动的首次公开募股（IPO）主承销商的背景下，这项政策变化格外引人关注。 IPO 进程中，该银行需要为一家公司的股票进行推广，而该公司标志性的编码产品却正在被从其自身大多数员工手中撤走。尽管该银行仍与 Anthropic 合作，使用后端代理来完成交易会计等事务性工作，但对前端人员的限制反映出大型金融机构在敏感场景中收紧对自主 AI 代理管控的更大趋势。
其他机构在这一转型过程中采取了不同做法。例如，Barclays 已把 Claude Code 推广给约一半的开发人员，但同时利用由此带来的效率提升来减少人员编制。与此同时，像 JPMorgan 和 Schwab 这样的机构则采取更强硬的立场，阻止外部代理访问客户账户。这些举措共同凸显出一种日益紧张的局面：一方面希望借助 AI 实现创新，另一方面又必须维持严格的监管合规和运营稳定。
Goldman Sachs 的这次调整表明，尽管 AI 驱动的生产力潜力巨大，但把代码生成能力交给非工程人员所带来的固有风险，目前仍超过其带来的收益。对其他组织的管理层而言，这同样是一则警示：在把由 AI 代理构建的任何工具接入生产环境之前，必须先建立清晰的责任归属与审查机制。当组织决定限制此类工具的访问权限时，也应同步优先梳理这些工具在实际使用中带来的洞见——因为最初的试验往往能揭示出一些合理的业务需求，而这些需求往往能够通过更规范的工程流程得到更好的满足。
Goldman Sachs has recently implemented new internal guidance that restricts the use of AI coding tools like Anthropic's Claude Code and Microsoft's GitHub to its engineering staff. This decision marks a significant shift from the bank's earlier approach, which had encouraged traders and bankers to use these agents to build their own custom software solutions. While the bank's chief information officer had praised these "vibe coding" efforts as recently as July, the new policy effectively removes these powerful tools from the hands of non-technical employees, limiting their use to the roughly 12,000 staff members within the engineering department.
The primary drivers behind this restriction appear to be productivity concerns, financial costs associated with token-based billing, and, most importantly, risk management. Unlike software developed by engineers, which typically undergoes rigorous review, testing, and deployment controls, tools created by traders often bypassed these safety checks. Because these coding agents can read files, write programs, and execute code with the same access as the user, the bank faced significant risks regarding information barriers and data integrity. Furthermore, there is the inherent danger of non-technical staff deploying code they do not fully understand, which could lead to critical errors or financial losses on a trading desk.
This change in policy is particularly notable given that Goldman Sachs is a lead underwriter for Anthropic's upcoming initial public offering. In the lead-up to the IPO, the bank is in the position of marketing shares for a company whose signature coding product is being pulled from the majority of its own workforce. While the bank continues to collaborate with Anthropic on back-office agents for tasks like trade accounting, the restriction on front-office personnel reflects a broader trend among major financial institutions to tighten the leash on autonomous AI agents in sensitive environments.
Other firms are navigating this transition in varying ways. For instance, Barclays has moved to adopt Claude Code for about half of its developers, though it is simultaneously using the resulting efficiency gains to reduce its headcount. Meanwhile, institutions like JPMorgan and Schwab have taken a more restrictive stance by blocking outside agents from accessing customer accounts. These actions collectively highlight the growing tension between the desire to leverage AI for innovation and the necessity of maintaining strict regulatory compliance and operational stability.
The move by Goldman Sachs suggests that while the potential for AI-driven productivity is immense, the risks inherent in delegating code generation to non-engineers currently outweigh the benefits. For leadership teams elsewhere, the situation serves as a cautionary tale: it is essential to establish clear ownership and review protocols for any tools built with AI agents before they are integrated into production environments. When an organization decides to limit access to such tools, it should also prioritize capturing the insights gained from how those tools were being used, as those initial experiments often highlight legitimate business needs that can be better served through formal engineering channels.
496 comments • Comments Link
• 在金融专业人士使用的主要工作站上运行自动化编码代理，会带来严重的安全风险。这类代理程序可能成为敏感客户、交易以及内部网络信息潜在泄漏的通道，并且可能仅因简单的 prompt injection 或用户的轻微操作失误就遭到破坏。
• Goldman Sachs 限制第三方编码代理，主要是为了防止未经授权或存在缺陷的代码进入关键的金融执行路径。人们担心的是：如果由非工程师创建的未经核实脚本在缺少适当审查、审计追踪或部署基础设施的情况下被投入使用，可能造成重大的财务损失。
• 非技术人员借助大语言模型制造的"影子工程"（shadow engineering）反映了过去使用不受管理的 Excel 宏或终端用户脚本时出现过的同类问题。这些工具往往在没有文档、测试或可维护性的情况下成为"关键路径"应用，从而形成组织难以承受的隐性系统性依赖。
• 金融机构在严格的监管与合规体系下运营，这就要求必须具备可审计的数据访问、细粒度的 entitlements，以及受控的通信渠道。能够抓取电子邮件或概括内部通信的自动化代理，会在不知不觉中绕过这些"Chinese walls"，进而引发巨大的法律与声誉责任。
• 企业级 AI 的使用通常需要托管的、具备沙箱隔离的环境，而不是在个人本地机器上直接执行。尽管像 Claude 这类基于订阅的工具对个人任务很有帮助，但大型组织正转向使用托管代理，并在基础设施层面强制执行安全性、治理与使用情况追踪。
• 对于拥有 150 名以上用户的组织，从固定费用订阅转向按使用量计费的 API billing，是行业常见做法。订阅计划往往是面向个人和小型初创公司的补贴型营销渠道；而对行业高估值至关重要的企业收入，则由基于 API 的高安全性集成来驱动。
• 大型企业经常陷入机构摩擦：技术团队被要求"改进"或支持数量庞大的低质量 AI 生成原型。这会给工程部门带来难以管理的负担，因为许多非技术用户缺乏基本认知，难以把"vibecoded"原型与生产级代码之间的差距弥合起来。
• 将这类工具限制在软件工程师范围内并非出于对 AI 的排斥，而是因为要管理 agentic 输出需要特定的专业能力。合格的工程师能够更好地评估架构风险、安全影响以及生成代码质量；而非工程师可能缺乏背景知识，无法判断代理何时在生成幻觉内容或采取危险行为。
• 围绕即将到来的 Anthropic IPO 以及内部政策调整时机所引发的利益冲突问题，仍是争议焦点。有人认为这存在战略关联，但也有人认为，银行的安全、合规以及 investment-banking 部门是在严格划分的汇报链条下运作的，以防止不当影响。
• 更广泛的行业趋势是向"全力投入"的 agentic 工程转变，也就是把安全性在设计之初就植入环境。在 AI 供应商能够提供真正"secure by construction"的工具之前，受监管的行业仍会倾向于采用更严格的遏制政策，而不是开放式的 agentic 访问。
这场讨论的核心在于：AI 带来的普惠力量，与高度受监管行业对安全性的严格要求之间存在根本性张力。尽管 LLMs 能显著提升生产力，但一旦被非技术人员掌握，它们生成未经核实的自动化代码的能力就会构成由安全性、合规性与运营风险叠加而成的"致命三重奏"。普遍共识认为，当前这股"vibe coding"的浪潮在企业环境中不可持续，因此有必要转向托管、沙箱化的 AI 基础设施；在这种架构下，通过政策与工程控制来管控风险，而不是让个人以开放方式直接访问。归根结底，整个行业正从把 AI 当作神奇的自助工具，转向将其视为一项复杂且高风险、必须在专业监督与严格内部标准下运行的能力。 • Operating autonomous coding agents on primary workstations used by finance professionals presents severe security risks. These agents act as a conduit for potential leaks of sensitive client, trade, and internal network information, which can be compromised by simple prompt injections or minor user errors.
• Goldman Sachs restricted third-party coding agents primarily to prevent unauthorized or buggy code from entering critical financial execution paths. The concern is that unverified scripts created by non-engineers could result in significant financial loss if deployed without proper review, audit trails, or deployment infrastructure.
• The "shadow engineering" created by non-technical staff using LLMs mirrors historical issues with unmanaged Excel macros or end-user scripts. These tools often become "critical path" applications without documentation, testing, or maintenance, creating hidden systemic dependencies that the organization is ill-equipped to support.
• Financial institutions operate under strict regulatory and compliance regimes that necessitate auditable data access, granular entitlements, and controlled communication channels. Autonomous agents that can scrape emails or summarize internal communications inadvertently bypass these "Chinese walls," creating immense legal and reputational liability.
• Enterprise-grade AI usage typically demands managed, sandboxed environments rather than individual, local-machine execution. While subscription-based tools like Claude are useful for individual tasks, larger organizations are moving toward managed agents that enforce security, governance, and usage tracking at the infrastructure level.
• The shift from flat-fee subscriptions to usage-based API billing is the standard for organizations above 150 users. Subscription plans serve as a subsidized marketing funnel for individuals and small startups, while the enterprise revenue—essential for the industry's massive valuations—is driven by API-based, high-security integrations.
• Large corporations often suffer from institutional friction where technical teams are tasked with "improving" or supporting a massive volume of low-quality, AI-generated prototypes. This creates an unmanageable burden for engineering departments, as non-technical users often lack the fundamental understanding to bridge the gap between a "vibecoded" prototype and production-ready code.
• The restriction of these tools to software engineers is not a rejection of AI, but a recognition that managing agentic output requires specific expertise. Qualified engineers can better assess architectural risks, security implications, and the quality of generated code, whereas non-engineers may lack the context to identify when an agent is hallucinating or acting dangerously.
• Conflict-of-interest concerns regarding the upcoming Anthropic IPO and the timing of internal policy changes remain a subject of debate. While some perceive a strategic connection, others argue that bank security, compliance, and investment-banking divisions operate under strictly partitioned reporting chains to prevent improper influence.
• The broader industry trend is toward "all-in" agentic engineering where security is baked into the environment by design. Until AI vendors can provide tools that are inherently "secure by construction," regulated industries will continue to favor strict containment policies over open-ended, agentic access.
The discussion centers on the fundamental tension between the democratizing power of AI and the rigid safety requirements of highly regulated industries. While LLMs offer significant productivity gains, their ability to generate unverified, autonomous code poses a "lethal trifecta" of security, compliance, and operational risks when placed in the hands of non-technical staff. The consensus suggests that the current wave of "vibe coding" is unsustainable in enterprise environments, necessitating a transition toward managed, sandboxed AI infrastructure where risk is handled through policy and engineering controls rather than open, individual access. Ultimately, the industry is moving away from seeing AI as a magic, self-service utility and toward treating it as a complex, high-stakes capability that requires professional oversight and rigorous internal standards.