People are giving all kinds of explanations here why Goldman is doing this, but they are not addressing what the article (implicitly) says: operating coding agents on the primary machines of finance professionals runs directly into the lethal trifecta. It's as simple as that.
You cannot have semi-unattended agents running on the same workstations that have access to client/trade/prop information and email client, and internet, and internal networks, it's too dangerous--a major leak is just one small mistake or prompt injection away. Banks are not stupid, they are getting it and shutting it down.
But they allowed that exact situation for a while now and no one cared. Stupid security but politically safe since Trump would never investigate.
Big corps never pivot throughout the whole corp for a single issue, only when risk in a certain context keeps compounding. The Dem wins compounded risk of legal action; it's not just that the laws are on the books. They were on the books a month ago.
"Yeah that's what I said it's to hedge legal risk."
It's the way you said it; ignoring potentially relevant political context. A lot the rhetoric demonizing politics is intentional to embed a negative reaction causing us to discount it's value
Who is solving federation and access control at scale? I’ve seen other companies doing this internally but have not seen a standardized product-y approach. This is a huge problem where I work as well.
Nobody is solving it, because it cannot be solved in the LLM architecture? They are mitigating it.
We should stop using "solve" when we mean "releasing products to target". Nobody will ever solve this problem with LLMs as they are currently architected.
I've been building an MCP server and an AI Gateway as two separate projects designed specifically to prevent agents from doing effectively anything programmatically, rather than trying to convince them with a clever prompt not to do a bad thing.
One of the key things is to have cryptographically confirmed audit logs and receipts for actions and decisions, and to separate out the agent's authorizations from the user's authorizations.
Separately, there is real work being done in the fintech community specifically to identify which agent has what control, when. And you can see some of the work there, which I've also contributed to.
I baked in lethal trifecta guards into my primary harness, DSCO, but it makes things much less smooth to run autonomously. Basically if you load secrets into a context, ideally it stops that and creates a process running a small local model that will write some code to not look at the secret and instead run code to operate on the secret without reading it in.
The risks are 1) exfiltration (network calls) 2) prompt injection (untrusted inputs) and 3) access to secrets
You can do some clever tricks like "spin up subagent without net access" to handle OCR of an internal document and have that agent communicate summaries to another "spun up subagent with net access" - imagine if one subagent is a local model and the other model is a frontier model over a web API. Maybe they still communicate in Neuralese or in abbreviated notes that you don't capture and are able to surreptitiously / covertly exfiltrate your information.
Ideally eventually you'll have some kind of dashboard that surfaces these risks as you're working.
Reports of AI researchers running massive swarms of 10,000 agents are definitely believable but the moment you start pulling in code libraries or other technology assets seems like you can get destroyed by a rogue actor. Definitely tons of unsolved problems here
Writing on mobile so this might poorly articulate the issue but it's interesting
What stops the agent from just writing code to actually read the secret? That’s kind of the core of the problem. The agent can be tricked into doing anything.
Indeed. But if it's a model running on your own hardware it isn't as risky. And the Anthropic models are actually pretty good at kind of writing code that will look at contents of a file without fully looking at the content, so it's insecure but not quite as bad as an open("secrets.txt").read()
I’m building an AI governance framework within a self-hosted AI agent platform designed for these scenarios: https://github.com/rush86999/atom.
I project that small businesses will be the earliest adopters of AI governance due to their lower barrier to entry and lower operational risk, followed later by highly regulated sectors like banking and healthcare.
Interesting idea, but even as someone building in the space I struggle to understand what is it about without digging.
open-source AI agent workspace for business workflow automation requires a lot from the reader and terms like agent/workspace/workflow are very prone to ambiguity and now you adding governance framework.
Yeah, I'm working on an open source product in this space [0]--particularly in finance--that's why I know about this problem quite a bit.
I think the solutions is to give people the ability to run agents that are "coding agent like" but in managed and governed infrastructure (i.e. not on their workstations). Basically, Meta Muse or OAI dots for enterprise.
It will take some time to find the right architectures and patterns. IMO, coding agents were just the first wave, much more interesting stuff and systems are coming.
That sort of risk could be controlled. Goldman has control of those desktops and could ensure Claude Code is always sandboxed, or they could offer it through a remotely hosted platform. I’d be very surprised if they were not already doing at least the former.
No, I think the risks they are talking about would include things like financial risk due to bad trades based on misinformation from buggy code that the authors don’t understand. This sort of policy pivot happens after an Incident that had a Financially Material Impact.
They also cited productivity concerns, which is also something I’ve observed: some people waste a lot of their time and other’s time due to using these tools to do work they do not understand.
Remote-hosted agents are available in most places. BUT they are not interesting, because they do not have access to all the user's data.
People really want to run agents on their data.
Re sandboxing: I dont know Goldman's particulars, but most enterprises lock down all sandboxing tech on workstations. So I assume this is actually harder than it seems. So people just run it directly on the machine.
The article is referring to the dilemma of the trifecta twice.
> Goldman has control of those desktops and could ensure Claude Code is always sandboxed
Agents have already broken out of what were supposed to be sandboxes in the networks of the companies that are supposed to understand what they do. Do you really think banks would be any better?
Some of that was negligence, but beyond expertise, we also need to think about which companies are willing to invest in the necessary barriers and accept the limitations that comes from obeying them.
It may just be there's no safe nexus for asbestos floor tiles, no matter how skilled the installers are.
I got a series of Teams messages from some random person at the work address yesterday asking me to fulfill some access request to them. I noted by the part of their org (wildly different from mine) that they were looking for a different person.
I responded by saying they were looking for someone else, and got a response to the effect of “oops that was Copilot, sorry to bother you”
OK so people who work in finance are doing this now? They just let Claude Code run amok on their machines, with all their employee credentials?
I am out of the loop with the industry, but I thought many people were using cloud agents and controlling them through tmux or something. But yeah I guess that also means you don't have access to do much.
Cloud agents or even sandboxes are too technical for most. And most corporate workstations do not allow sandboxing of any kind (virtualization or containers).
> And most corporate workstations do not allow sandboxing of any kind
I don't think that's phrased correctly. What corporate it does is set policies. Often those policies disable virtualisation. (They don't disable sandboxing - that's used in many ways and security loves that) But if the business need is to run LLM agents safely, the policies will be changed to dictate how to run agents safely.
2) the product cannot, on an architectural level, be fixed to stop it
3) they are helping the maker of the product go to IPO
If banks are not stupid, they'd say "hey, this presents an unacceptable risk to our customers and by extension, to us, maybe this isn't something we should be involved with".
operating coding agents on the primary machines of finance professionals runs directly into the lethal trifecta.
I've professionally interacted with GS for over 30 years. It blows my mind that GS allowed real exposure to "the lethal trifecta" for even a moment in time.
At our org they have been clawing back Claude access because of chronic billing overages. Budgets are tight and consumption billing models are being stamped down on everywhere. Anthropic sales can not offer us any sort of normalized billing rate.
Gemini is swooping in because they offer flat consistent billing and handle overages through throttling access to higher models. For 90% of the non-engineering org the experience is near enough it makes no difference.
I don't get how this is such a common issue. Are companies paying API rates for devs? The $20/mo plan pretty much works fine for most people at my company
But I wonder whether the cost shown to us is what the company actually pays? Pretty sure finance would have written a discount which is not shown to employees to keep us in check.
My hearts says that's what going on but ... does someone know?
I looked into this the other day - it's hard to get concrete numbers but rumors online lead me to believe that negotiated discounts tend to only be in the 10-15% range and you need to commit to six figure of spending to get them.
The actual cost your company pays is likely _higher_ than what Claude Code shows in /cost, not lower. Also, very few organizations are getting any discount on API rates. Maybe the US military.
For businesses anthropic offer a teams plan for up to 150 users which is billed like a collection of individual users i.e. you have a seat, you get some tokens/month, you buy a higher tier seat and you get some more tokens/month. For >150 users you pay $20/month/user just for access to the platform, then all tokens are billed at API rates.
No, that's the whole business model -- the subscription plans are a teaser with mixed-to-low profitability, but they're self-serve, have low support demand, and create a breadth of familiarity and brand attachment. It's a genuinely good deal for individuals and small businesses but represent a subsidized marketing program for Anthropic and OpenAI.
Enterprise sales are where the revenue for the $1T valuations comes from. If they were forced by competition to offer subscriptions to all those organizations, they'd blow up tomorrow.
What other offerings? The other providers are either similarly priced for enterprises, or nonstarters for security reasons (there's very real concern in enterprises about hosted open models being modified to covertly inject security vulnerabilities, and it's not cost effective to self-host them.)
Is that some sort of legacy pricing? because on https://chatgpt.com/pricing/?type=team I see an option of either £15/ month or £75/ month, per seat, 2 seats required. So it's more expensive than a single £89/ month pro subscription.
I honestly can't imagine using a bigger plan. The $20 a month plan is able to be used almost all day without hitting the usage quota so long as you moderate what model you're using.
I really don't understand why so many people seemingly use the bigger plans. Are people just running opus 5.5 as 4+ subagents 24/7?
In order for me to actually understand what's being done, I always keep it brief and use specific prompts (and usually use smaller models since they're perfect for that). Do people just let "claude take the wheel"?
When you have to go in to your next standup and explain what your code does to your boss, and what you've done since the last meeting, what do you say?
> When you have to go in to your next standup and explain what your code does to your boss, and what you've done since the last meeting, what do you say?
I hand them a writeup of how incorporating agentic decision making into cleaning up some of our messy data saved us $XXX,XXX at a cost of $XX of tokens, with the receipts attached.
How do you get along with the 20USD plan and that much utilization?
I use Claude mainly via Webinterface and when on Opus 4.8 or higher, I reach my weakly limit around 2 - 3 days before rest - and Im just prompting single/specific very limited & constrained classes & functions with proper description and architecture upfront.
I run 4 agents under one supervisor agent for 12 hours a day building computer use environments. Yes, I don't read the code, but testing is 90% of my work. Got to find other ways to buy trust in AI code. I came up with a stack of 5 layers of testing which is pretty similar to the recent Anthropic writeup. I can consume the $100/mo plan weekly quota in 2 days.
I let Claude take the wheel with various non-professional projects which often means heavy subagent workflows. Prompts like this easily eat through my 5x Max plan limits:
> I want you to look for UI issues related to transitions. Look for jumps, reverts, or anything that doesn't follow UI/UX best practices. You might need to figure out how best to even record and review UI transitions. Do all testing locally on a local dev server, but make sure to undo any database changes you make in the process of testing. Be exhaustive and report back with an .html report that highlights the visual issues and proposed solutions so I can review each one. Ultracode on.
Which means I have up to 10 Opus 5.5 medium agents running concurrently for long stretches of time.
I want to be clear I don't think that using Claude in this way gets you the best possible results. But when the app is fully vibecoded then audit prompts like the one above can be seen as a definite net positive. Making Claude think really hard about various improvement routines will get you better results in that one aspect than Claude's first attempt to build something from scratch did.
Is just the first hit your dealer gives away for free. Treating that as the actual baseline cost for what they need in order to justify current AI valuations requires some truly fraudulent mathematics. Hell, even the current API rates are unsustainable -as-long-as- they need to keep investing into training the next model they will be serving 6 months from now.
The plan has always been to develop these models using borrowed money, get everyone's business process addicted to them, moat off access to alternatives (e.g. chinese / foreign open-weight models), via technical superiority -or- more likely regulatory shenanigans, THEN jack the prices up through the roof starting with direct enterprise customers buying API access but then obviously bubbling down into literally every product / service every human being on this planet purchases. Unfortunately, it's a garbage plan based on a multi-ton house of cards that is about to collapse on everyone.
Yes, in industries where you have legal/regulatory/security restrictions on your data, you pretty much have to pay API rates. Furthermore, if you buy through providers like AWS Bedrock or GCP Whatever-The-Fuck-They-Renamed-Vertex-To, depending on your setup you may not benefit from the pricing on cached tokens. It can anywhere from 10x to 100x the prices you pay.
their subscriptions aren’t subsidised. in fact its near 100% margin. you are getting the lowest priority access with no service level guarantee in the gaps in supply left over by api users, anthropic’s cost basis on hardware would be the same without subscriptions.
The most interesting part of this announcement is the timing. GS is leading Anthropic's IPO, what motivated them to announce this a few weeks before trading starts?
In an honest, well-functioning org, those are decisions made by completely different groups that do not (and should not) report to each other. It's actually kind of depressing that we (and I include myself in that) assume otherwise by default.
I have bad news: most large corporations are successful because they know how to make money. Often, the internal operations, are disappointingly bad, just not bad enough to kill the corp fast.
Source: I've worked in and with many successful organizations, and worked at one place with proper internal processes, so I know what's possible
I have observed that also. Though I'm still not sure whether: 1) there are some small pockets where important decisions are made, innovation happens and the needle is moved, and dysfunction I see is just justified bloat of the company 2) it is the entire corporation like that but it somehow works at the end.
I'm no longer in that industry, but as I recall there are actually rules imposing independence from investment banking and research arms, for example. Dates back to the Dot Com era where research analysts were touting IPOs for the investment banking division.
> In an honest, well-functioning org, those are decisions made by completely different groups that do not (and should not) report to each other.
I don't agree at all. Different groups should be supporting each other and the overall bottom line instead of their parochial, narrow self-interests - the latter is a poorly functioning org.
If by group A delaying its $100M cost-cutting, group B can add $1B to the bottom line, it would be a corporate and group management failure for group A not to cooperate.
Well functioning by what metrics? To make money? No doubt Goldman sachs does that. But making money often has the incentive of ignoring ethics .. which is what this thread was about. Would they ignore ethics to make more money?
So here, would they synchronize announcing big things in relation to the hottest and most risky investment there is right now?
"what motivated them to announce this a few weeks before trading starts?"
Also what’s your point? Goldman Sachs shouldn’t pull Claude Code because there’s no point in trying in this world and we should all give up on everything?
This wasn't announced, it was an internal leak reported by Bloomberg. Perhaps they should have known it would leak, but there doesn't seem to be any grand strategy.
At a large bank like this, the people responsible for cybersecurity have a completely separate reporting chain and incentives than the ibanking side. If there was a security risk identified, it'd be completely inappropriate to wait a few weeks.
Regardless of tech tool, non-tech writing POCs they try to force tech to get into production is a timeless story. LLM just allows people to get there faster, with less knowledge of coding.. which leads to the actual problem I think.
Banks have a ton of legal/compliance/reglatory/reputational concerns about application access/entitleements, data privacy, data licensing, granular data entitlements, data access (auditable).. approval chains (auditable), as well as actual financial risk.
It could also be as simple as the technology adjacent people developing tools via LLM that somehow end up in the critical path of some business function and now it needs to be supported by someone.
I’ve seen the same happen with insane spreadsheets.
As empowering as something like Claude code can be, leaving development to developers means the output is inherently supported by the organization long term.
Extending the thought, there’s also the risk it enters critical path but something upstream changes or Anthropic starts charging 1000x for the tokens and now someone needs to walk through god knows how many lines of never before reviewed code to figure out how it works.
By wholly depending on the assisted coding you are wholly dependent on Anthropic, forever, for something that is now critical.
There are probably thousands of these little microscopic dependencies that occur when you make these tools widely available. What happens when you don’t want to foot the bill anymore?
This is what happens. We had this happen with end user scripting pre AI where these scripts became unknown production applications. It made the actual engineering impossible because you had no idea if anything you changed would impact the ??? processes run by users that have become critical. AI would amplify that greatly so we have an explicit rule that it can only be used for reporting and prototyping only and we restrict any write action
I am co-teaching an AI course for college business students. We decided to use Claude Code and Visual Studio since the space is moving so quickly and we thought understanding some of the fundamentals is the most value they could get from the course.
It was the right choice. But many of the rough edges of the terminal do surface and confuse non technical people.
Getting there faster with less knowledge of coding isn't the problem.
Pre LLMs, the main barrier to producing software for non-tech people was writing the code, literally. With LLMs, this barrier is now gone. This results in a much larger volume of slop than before. And then the real barrier shows up -- understanding, fool-proofing and maintaining that code. Code is cheap, show me how it runs in prod.
Like it's great that quants can iterate on their ideas much faster now. But GS is saying they shouldn't leave their sandbox.
Maybe there is an irony in that LLM with coding harness could be a step in the right direction for operational domain experts to solve business problems while maintaining high standards for legal/compliance/regulatory/reputational and prd-deployment concerns.
User scripts that turn into applications that need production support are often consequential and business-differentiating since they do the things that can't be bought off the shelf and effectively encode tacit knowledge.
> The Hong Kong restriction was based on location and contract terms, and the new one is based on role. Goldman's in-house AI assistant, which uses models from several companies, is still available across the firm. The restriction applies to third-party agents that can write and run code by themselves.
Goldman is very unlikely to have decided proactively to cut off traders access, and it's much more likely there was an operational loss. What kind of loss? I don't know but consider:
1) Claude Code is only being taken away from traders.
2) Only traders have permission to send orders to the market and book client trades.
3) Claude code would have been running as the trader, under their account with minimal review.
If you run a coding agent in that environment it's only a matter of time until it enters a bad order or books a bad trade, and once that happens it's only a matter of time before management decides to take this kind of action.
Goldman is definitely not doing this for cost reasons. They can afford the tokens.
As the things stand, we used to have thousands of Excels with obscure macros heavy-lifting businesses. Now we have thousands of Claude artifacts doing the same. Nothing has changed, much less improved.
Wherever I've seen a pull back, it is all because of compliance or security. And that too not because of the purity of heart; but because some checkbox couldn't be ticked due to AI.
Excel macros are deterministic, don't leak BI and PII, aren't malware, and don't cost an extra engineer's salary per engineer. Comparing them to Claude is quite a disservice.
Not to forget versioned inside the document. The same spreadsheet produces same answers if it is not edited. Same can't be said from programs that can be recreated over and over again.
It's really hard to make these models useful and safe. Useful means wide adoption, long running tasks with no human in the loop, wide access to read and write data (analysis, summaries, dashboards, etc).
Safe means containers, guardrails, egress filters, human in the loop, deliberate per agent mcp controls, and real expertise in prompting/task selection, etc.
So far the pattern I've seen is security teams say no, it gets escalated, it's allowed, then 1% of the time the model yeets data where it's not supposed to (no amount of promoting or controls seems to really fix this), it's locked back down.
This just means Claude Code on their bankers/traders laptop is not ok, they will buy managed agents and similar products for non-engineers. Sound like high margin products to me.
Every company is struggling with the right balance right now. All the more impossible as the quality of the tools changes so dramatically every quarter.
Well the real question is: Is this about using AI, or switching from public AI to private AI, or about Anthropic having access to confidential information of their own underwriter?
Look no further than the recent email leak story. The tool is quite powerful and I can see the argument that at an enterprise / risk management level it should only be used by those capable of reviewing it.
Uhh... colonial empire? See also: HSBC and Standard Chartered. For those unaware, one of France's largest banks, BNP Paribas is also an old colonial bank from... wait for it... Netherlands! Paribas stands for "Banque de Paris et des Pays-Bas". For those unaware, the old French term for the Netherlands (Holland) is the low countries, which is literally "Pays-Bas" in French.
To be fair, UK's #1 talent and economic advantage for global commerce in 2026 is their contract law and the courts that judicate it. It is unmatched globally. Sure, New York, Paris, Tokyo, Hongkong, and Singapore are pretty big, but nothing competes with London for international contract law. The ecosystem is just so massive and concentrated in London -- courts, highly experienced judges/barristers (lawyers)/academics.
Businesses are just realizing that spending 50k a year per employee on an app/ide doesnt make sense...
Im not convinced it's creating any economic value at all.
Like 10% of people use it reasonably/responsibly and the other 90% basically become turbo lazy. I think I'd rather my employees be working "slow" but actually working hard and not just functioning as meat proxies for mediocre bots and reducing my workforce to some median competency.
There's no edge in using the same tools that everyone else is using, especially in markets/finance.
Let your competition all melt their brains, maybe only give employees you know are actual super contributors, (and not just mentally offshoring their work) unlimited access to llms.
I dunno, I have a lot more sympathy for non-technical users writing slop than engineers. I think it's really great that more people get to "properly" use the computer, in that they experience a flexible programmable environment, rather than a fixed set of discreet programs "take it or leave it".
If the issue is security, a much more interesting problem for the engineering team to do is design the programming environment for the bankers so they cannot hurt themselves.
If the issue a performance, designing great abstractions that the bankers' agents can use is "low code done right".
I hope the bankers rebel hard against this policy change!
The ability of bankers or traders to even create an app that others can run, without any IT review/approval process is probable a compliance issue in and of itself.
There are things simple building blocks don't prevent in the event of nefarious or stupid behavior.
Imagine a nefarious banker creates an app that lets him talk to a trader on the other side of the "Chinese wall" about M&A deal flow without getting caught because they are avoiding monitored channels like email, slack, phone, zoom.
Imagine an idiot writes an app that scans his email and summarizes client information he is privy to and writes it to some database that his app then serves up to others on the trading desk. He is unaware that entitlements exist, and by giving others access to his new app he has broken them. Btw summarizing email is a HUGE use case across non-technical users in finance that they are very excited about.
> Imagine a nefarious banker creates an app that lets him talk to a trader on the other side of the "Chinese wall" about M&A deal flow without getting caught because they are avoiding monitored channels like email, slack, phone, zoom.
Back channel conversations have been happening since forever and hardly need vibe coded apps to pull off. They can use non-corp services on personal devices, or kick it old school and grab drinks at the bar downstairs.
The point is liability, plausibly deniability, etc.
If a trader uses their personal cell / WhatsApp / etc in today's age, all the liability falls on that trader.
If organize drinks with a coworker adhoc and communicate things they shouldn't.. the same.
However, if a trader on their work PC, on the work network, in the office can communicate in electronic form on an unsecured, unmonitored channel.. the bank is paying a very large fine. This is like leaving gmail unblocked on work computer/network.
Likewise if the bank itself organizes a monthly drinks between 2 departments on different side of the Chinese wall, offsite and things get communicated that shouldn't .. its obviously somewhat intentional by the bank and they will get fined.
>The ability of bankers or traders to even create an app that others can run, without any IT review/approval process is probable a compliance issue in and of itself.
I feel the same way. There's also a lot of startups promising this future but none of them are technically equipped to deliver it. I think almost every company is going to have an interesting ecosystem of internal apis in the future.
Yeah it should be a dialogue with bankers / front office. It can even be "OK if you wanna do this, we gotta teach you at a high level how the computer works, so we can figure out broad company policy together". Done right the rest of company finally gives a shit (because they want to keep their cool new personalized toys), and it's never been a better time to be back office IT.
In certain industries, compliance/lack thereof has serious consequences, so it might be more to do with that rather than punishing non-technical users just for using AI. For example, if an AI model trains on your internal financials, and someone else uses it to make a quick buck, then that's insider trading. Things like that.
Good security policies always contain building blocks. If your security realies on low-privilage code been fully human-auditted, you've already lost.
Only select high privilege code, where we don't know how to make it "secure by construction", should depend on full audits.
The right use-case here is "custom homegrown Bloomberg Terminal add-ons", not autonomous trading software that can see everything and also isn't routed through trading risk software.
There have been a lot of recent issues with LLMs finding security bugs quickly. If the issue is security, they need to design the bulletproof platform first, then give the less-technical users access to it.
I dunno if rebellion is the right framing. Maybe pulling the organization toward their side instead. Ultimate the “bankers” at an investment company decide where the company is going, after all. Grabbing your own steering wheel isn’t rebellion.
Yeah, I wonder if the medium term shift here is away from CC (which runs on your own machine and is super risky if you have sensitive client information) to something like Claude Managed Agents, where everything is sandboxed.
Or just the Claude app with local execution disabled by org policy, if that’s a thing.
The sensitive data problems aren't just about sandboxing. If a systems development model at Anthropic discovers a clever optimization trick based on a customer's complaints to their account team, that's a great deal that saves a lot of work. If a trading model at Goldman discovers a clever pricing trick based on a customer's complaints to their account team, that's an enormous problem, even if the underlying data is never seen by anyone who Goldman wouldn't trust to handle it responsibly.
Sure, but moving to CMA lets you enumerate the sources and assert the customer complaints are not visible to the workflows that shouldn’t have it.
The “Claude can read everything” model is great for vibe coding but not suitable for regulated industries, which require more structure.
My point is mostly that there is a middle ground that can preserve some of the wins; Claude can vibe up a CMA pipeline pretty quickly. There’s likely room for an internal platform to enforce required invariants though.
> rather than a fixed set of discreet programs "take it or leave it".
> If the issue is security, a much more interesting problem for the engineering team to do is design the programming environment for the bankers so they cannot hurt themselves.
Interesting take but it doesn't compute. When engineering team teams design programming environments so that people can't hurt themselves they will be locked into a "take it or leave it" set of environments.
Also, you do know security isn't just about engineering, it is also about data right?
How do you suppose it works when bankers who have day to day access to sensitive data as part of their job - upload it to AI? What to do then? Restrict data access?
> rather than a fixed set of discreet programs "take it or leave it".
This part always amuses me. AI boosters seem to think everyone hosting their own bespoke app is the next big thing. But who manages that? Banks are not tech giants. Most engineering teams don't bring in money and headcounts are strictly managed. As the article says:
> "He told Bloomberg that traders and bankers had built tools with AI and passed them to the firm's engineers, of whom there are about 12,000, to be improved."
So, how does engineering with limited staff design a safe environment and improve 12k apps. I am sure Goldman's management wont be thrilled about increasing engineering headcount to match these expectations.
> they experience a flexible programmable environment, rather than a fixed set of discreet programs "take it or leave it".
> If the issue is security, a much more interesting problem for the engineering team to do is design the programming environment for the bankers so they cannot hurt themselves.
> If the issue a performance, designing great abstractions that the bankers' agents can use is "low code done right".
You do realize you're contradicting yourself right? To get to a state where "bankers cannot hurt themselves" or "low code [is] done right" is to end up right back at the "take it or leave it" programs.
Security was already addressed, by these "take it or leave it" programs.
Add enough abstractions on top of each other that must be adhered to or else it falls apart, and what do you get? "take it or leave it" programs.
This reminds me of the sovereign citizen movement that got really popular in 2019. The illusion of freedom feels great I'm sure. Until you realize you are entirely dependent on the existing infrastructure and the people who maintain it to enjoy the apparent freedom.
The issue is probably an overwhelming amount of slop like PoCs, presentations on every topic, claude artifacts with 1000 pages instead if 10 liner in the chat.
All this is just counter productive and drowns everyone is slop.
I'm not surprised in the slightest. Claude Code is a proprietary mess that only serves Anthropic, not any of the people using it. In a financial setting, I've had disastrous results with it. This is a good move Goldman Sachs, and I think everyone will be happy it happened.
Claude writes code just fine, and can create shareable "artifacts" that may have full backends, databases etc.
Claude Code is a poor fit for non-engineers, it carries a lot of features, vernacular, and patterns that don't make sense to people that don't code.
So I don't think this means much? All of the coding functionality a non-engineer could want is still available, just no need to switch to a different tab in the Claude app (or even worse the terminal).
A reasoning cited in the article is that there was no source control in place for the trade tooling that Goldman Sachs finance employees were building.
I'm guessing that + probably the absence of any deployment infrastructure for the finance people to be forced to use made Goldman Sachs' eyes widen and pull the plug immediately before something blows up (if it hasn't already internally).
I also wonder if a lack of diligence with Claude Code (or any LLM tool for that matter) resulted in private information getting leaked, and that feedback is just now getting back to them.
In terms of the big picture of the industry and the AI bubble though, yeah this isn't too big of a deal.
Internal guidance updated in October restricts Anthropic's Claude Code and Microsoft's GitHub to the bank's engineers
There. Now only devs can use Claude Code. That makes sense.
Has nothing to do with AI being bad. Good engineers have a mind for it. They tend to be more detailed oriented. Understands how parts connect. Understands the pros and cons of approaches. Can see when the AI does something stupid. Probably knows a better way if the AI veers off.
We don’t ask software engineers to file Goldman Sachs yearly company taxes using just AI right without any expertise right?
We don’t ask engineers to go out and do cold calls for sales right? Engineers don’t have the mind for that. They’d suck at it.
We don’t ask sales people to write programs right? Have you met a sales person? They’re the opposite of builders. They lie, take corners to close a deal. You can’t do that building a real production system.
> There. Now only devs can use Claude Code. That makes sense.
This hardly makes sense to me. Claude Code is an excellent tool for running your environment and augmenting your productivity. Most traders are sharp folks who could use CC to great effect I am sure. I'd be super annoyed.
It does make sense. But the problem is that no one wants to spend a few trillion dollars on a nice tool for devs. The investors want the magic wish-granting genie they were promised.[1]
Yeah, this is more likely to not waste engineers time while dipshits vibe code their own "tools" and demand that they are production ready despite being said dipshit.
On one end of the spectrum you've got presumably you, who brings a sketch or prototype to engineering, and has a reasonable discussion about what can or cannot be made production ready on what timeline, with what budget.
On the other end you've got people who bring a half baked prototype to a couple engineers, demand it be in production next week, and then escalate and make a big scene when there's pushback.
No engineers tend to complain about the former. The latter is stressful as hell
> "He told Bloomberg that traders and bankers had built tools with AI and passed them to the firm's engineers, of whom there are about 12,000, to be improved."
As someone who has been on the receiving end of many of these tools, I feel 'improved' is doing some heavy lifting here.
Completely overhauled to be operationally viable, perhaps.
Thrown into the dark recesses of the backlog, more likely.
I have a non technical friend who's been building apps for his (much smaller than goldman) investment bank just as an ingestion for their old pitch decks, deal documents, live deal agent that can surface tasks from emails and then work on things for the bankers. Been impressed with how seriously he's getting into CI, SDLC, etc but I don't think most management or business users are on the same page he is.
> A trading floor is a bad place for unreviewed code written by people who can't read it, and the information barrier problem would be reason enough on its own. Requiring that agent-written code come from people trained to review it is a sensible rule for a regulated business.
Jokes on them: devs are also losing the capacity to read the code. Can't mix move fast, high volume with "read code".
You have to go all in on agentic engineering. And if you're all in on agentic engineering and doing it well, then anyone should be able to build safely and no one needs to look at code. The code should look highly consistent and agents should be enforcing best practices, approved architecture, running security scanning, etc.
The gains at the middleground compromise are not really significant and, IMO, creates frustration and friction.
Works best to go all in. GS should let everyone have CC and GH and focus on making their enterprise harness safer for everyone.
I bet engineering loved traders tossing vibe-coded crap across the wall and demanding it be productionized. "It can't be hard, after all I've already written the code for you."
For decades Wall Street traders have been throwing spreadsheets over the wall at developers to be productionized.
The details are very different, but variations on this theme have played out for a long time. I have seen fixed income instrument modeling systems 20 years ago that allowed Traders to put in limited C++ code to define new exotic instruments.
If it is just a stateless UI, then probably fine. I've converted a number of these into production apps and the gaps existed in places a non-technical person wouldn't look: the overall architecture, database schema, security, and handling of edge cases to name a few.
When the AI companies are making the big math breakthroughs, it's clear that one of the most lucrative things they can do with their capability is hold it back and run a hedge fund. Knowing how Goldman and others do things at all levels is a massive accelerator. Goldman just woke up to that fact.
Jokes aside, I bet this sums up the difference between an engineer and a regular user who might just use whatever API they can find (although I concur that no single 2026 LLM would ever propose that).
Check out the image in the article. Take a close look at the middle trader. I've heard about "one arm tied behind your back" but this is the next level.
is this gonna have an impact on gas prices in Europe, too?
is claude on the waiting list of shooting stuff going through the strait of Hormuz?
isn't goldman sachs like a caring foster step mother to big AI corps in the MSX White Label OpenAI NVIDIA Soviet?
wait, are they about to increase prices while deteriorating the current cohort of models? god damn it!
did the whole rewind on RE cause a bit of an AI getting worse cuz it cant use the best AI anymore syndrome, some inverse of AI imposter syndrome? ho-ly shit!
Programmers are still allowed. It is curious that GS sued an engineer leaking source code to a competitor in 2009 when they now voluntarily give up their entire source code to Anthropic.
Apparently they finally got the memo that leaking corporate secrets for at least traders and bankers is unwise.
I never understand why Goldman Sachs gets so much attention for their technology. Their tech stack for front office (sales, trading, quants) is utter shit -- Slang is like a closed-source poor man's Python, and SecDB (their database) has no SQL interface -- only key-value pair (like a NoSQL database). The tech stack at JPMorgan and Morgan Stanley is light years ahead. My only explanation: The Goldman PR team is unbeatable. I assume that they are sometimes paying/bribing media to run stories. To be fair, Goldman's risk taking is excellent, but their tech stack in 2026 is so mediocre.
OK so when push came to shove, the frontier of LLMs were not trusted at Goldman Sachs. Maybe more banks to follow? Maybe other professions? The market cap for that juicy 2 trillion dollar evaluation shrinks for each one. Especially bad if the financial system itself doesn't trust the product.
There are some tools that require training to use and cannot be used by just anybody, like Cranes. they are powerful, but required specialized operators.
Just on another thread today or yesterday we have a Claude code developer saying “permissions are old hat”… so not shocking that a business with real infosec concerns would dial back on the product.
My wife is an MD and I got her using Claude Code for all sorts of tasks adjacent to but not actually generating code that will be used by others. I am quite sure Claude is writing code to accomplish the tasks she asks for, but she doesn't really know or care about that. She also uses Claude for family stuff, she had Claude build us a packing list artifact that helps us pack for our family vacations, and he now manages our address book, friends birthdays, an other family administrivia.
> Claude is writing code to accomplish the tasks she asks for
Is this typical behavior with LLMs not just Claude, but you can discourage from doing so by explicitly stating not to use tool or only use knowledge either in the system prompt or user prompt.
LLMs are trained to use tool if they can't solve a problem rather than guessing/hallucinating.
A dumb example is asking to count. As the range grow it'll attempt to write a script or use commands like seq to generate the numbers.
I work in healthcare-adjacent tech. You can use Claude with HIPAA/PHI. You need to sign a BAA (Business Associate Agreement). It dictates how Anthropic may use and how they must safeguard the PHI (Private Health Information), including not training on it.
I assure you that Claude and other LLMs are used extensively in healthcare, with PHI access, just about everywhere.
Don't be naive. Don't be alarmist.
If anything, LLM use under these conditions is far more safe than the way most people use LLMs. Engineers who aren't under any regulatory regime like HIPAA are using LLMs without the BAA safeguards, exposing personal data directly to the insecure, shared models, which are now training on all the personal data that's being fed into them. People think their communication with LLMs is private and isolated, but without the BAAs in use by companies under compliance regimes, it's not isolated.
To me it’s the phrasing “I got her using Claude code”. Maybe that means “I helped her set up access through her employer approved AI account” but it’s not exactly that common for such access to be set up by your husband. It just as plausibly means “she’s using the same personal account she’s using for the family tasks I also mentioned”. I don’t see that concern as naive so much as in tune with the way people frequently use tech.
I was using Claude Code yesterday for iterating with Claude Design. At some point it got faster and started producing screenshot PNGs of the canvas locally. I asked it what was up and it said that it wrote a local renderer to simulate the Claude canvas runtime.
You cannot have semi-unattended agents running on the same workstations that have access to client/trade/prop information and email client, and internet, and internal networks, it's too dangerous--a major leak is just one small mistake or prompt injection away. Banks are not stupid, they are getting it and shutting it down.
Big corps never pivot throughout the whole corp for a single issue, only when risk in a certain context keeps compounding. The Dem wins compounded risk of legal action; it's not just that the laws are on the books. They were on the books a month ago.
"Yeah that's what I said it's to hedge legal risk."
It's the way you said it; ignoring potentially relevant political context. A lot the rhetoric demonizing politics is intentional to embed a negative reaction causing us to discount it's value
We should stop using "solve" when we mean "releasing products to target". Nobody will ever solve this problem with LLMs as they are currently architected.
My work can be found at https://DollhouseResearch.com, and it's almost all open source with the code on GitHub.
One of the key things is to have cryptographically confirmed audit logs and receipts for actions and decisions, and to separate out the agent's authorizations from the user's authorizations.
Separately, there is real work being done in the fintech community specifically to identify which agent has what control, when. And you can see some of the work there, which I've also contributed to.
https://advancedaisociety.org/proof-of-control
The risks are 1) exfiltration (network calls) 2) prompt injection (untrusted inputs) and 3) access to secrets
You can do some clever tricks like "spin up subagent without net access" to handle OCR of an internal document and have that agent communicate summaries to another "spun up subagent with net access" - imagine if one subagent is a local model and the other model is a frontier model over a web API. Maybe they still communicate in Neuralese or in abbreviated notes that you don't capture and are able to surreptitiously / covertly exfiltrate your information.
Ideally eventually you'll have some kind of dashboard that surfaces these risks as you're working.
Reports of AI researchers running massive swarms of 10,000 agents are definitely believable but the moment you start pulling in code libraries or other technology assets seems like you can get destroyed by a rogue actor. Definitely tons of unsolved problems here
Writing on mobile so this might poorly articulate the issue but it's interesting
I project that small businesses will be the earliest adopters of AI governance due to their lower barrier to entry and lower operational risk, followed later by highly regulated sectors like banking and healthcare.
open-source AI agent workspace for business workflow automation requires a lot from the reader and terms like agent/workspace/workflow are very prone to ambiguity and now you adding governance framework.
I think the solutions is to give people the ability to run agents that are "coding agent like" but in managed and governed infrastructure (i.e. not on their workstations). Basically, Meta Muse or OAI dots for enterprise.
It will take some time to find the right architectures and patterns. IMO, coding agents were just the first wave, much more interesting stuff and systems are coming.
[0] https://ls.bot, https://github.com/smartcomputer-ai/lightspeed
No, I think the risks they are talking about would include things like financial risk due to bad trades based on misinformation from buggy code that the authors don’t understand. This sort of policy pivot happens after an Incident that had a Financially Material Impact.
They also cited productivity concerns, which is also something I’ve observed: some people waste a lot of their time and other’s time due to using these tools to do work they do not understand.
People really want to run agents on their data.
Re sandboxing: I dont know Goldman's particulars, but most enterprises lock down all sandboxing tech on workstations. So I assume this is actually harder than it seems. So people just run it directly on the machine.
The article is referring to the dilemma of the trifecta twice.
Can the agent read the internet for context? What if the fetch reveals a secret?
Agents have already broken out of what were supposed to be sandboxes in the networks of the companies that are supposed to understand what they do. Do you really think banks would be any better?
It may just be there's no safe nexus for asbestos floor tiles, no matter how skilled the installers are.
Supposed to understand, yes. I think a highschool class could do better.
I responded by saying they were looking for someone else, and got a response to the effect of “oops that was Copilot, sorry to bother you”
Read into this what you will.
I am out of the loop with the industry, but I thought many people were using cloud agents and controlling them through tmux or something. But yeah I guess that also means you don't have access to do much.
I don't think that's phrased correctly. What corporate it does is set policies. Often those policies disable virtualisation. (They don't disable sandboxing - that's used in many ways and security loves that) But if the business need is to run LLM agents safely, the policies will be changed to dictate how to run agents safely.
1) everyone can run into the lethal trifecta
2) the product cannot, on an architectural level, be fixed to stop it
3) they are helping the maker of the product go to IPO
If banks are not stupid, they'd say "hey, this presents an unacceptable risk to our customers and by extension, to us, maybe this isn't something we should be involved with".
But no.
I've professionally interacted with GS for over 30 years. It blows my mind that GS allowed real exposure to "the lethal trifecta" for even a moment in time.
Gemini is swooping in because they offer flat consistent billing and handle overages through throttling access to higher models. For 90% of the non-engineering org the experience is near enough it makes no difference.
I don't get how this is such a common issue. Are companies paying API rates for devs? The $20/mo plan pretty much works fine for most people at my company
Anything above that requires an Enterprise plan, which is billed at API rates.
But I wonder whether the cost shown to us is what the company actually pays? Pretty sure finance would have written a discount which is not shown to employees to keep us in check.
My hearts says that's what going on but ... does someone know?
Enterprise sales are where the revenue for the $1T valuations comes from. If they were forced by competition to offer subscriptions to all those organizations, they'd blow up tomorrow.
My personal ChatGPT account is a Business account with 2 seats at $30/ea (minimum 2 seats required).
Why? Because for $60 you get ChatGPT Pro, significantly cheaper than the $100 normally required for the next level personal plan!
I really don't understand why so many people seemingly use the bigger plans. Are people just running opus 5.5 as 4+ subagents 24/7?
In order for me to actually understand what's being done, I always keep it brief and use specific prompts (and usually use smaller models since they're perfect for that). Do people just let "claude take the wheel"?
When you have to go in to your next standup and explain what your code does to your boss, and what you've done since the last meeting, what do you say?
I hand them a writeup of how incorporating agentic decision making into cleaning up some of our messy data saved us $XXX,XXX at a cost of $XX of tokens, with the receipts attached.
I use Claude mainly via Webinterface and when on Opus 4.8 or higher, I reach my weakly limit around 2 - 3 days before rest - and Im just prompting single/specific very limited & constrained classes & functions with proper description and architecture upfront.
> I want you to look for UI issues related to transitions. Look for jumps, reverts, or anything that doesn't follow UI/UX best practices. You might need to figure out how best to even record and review UI transitions. Do all testing locally on a local dev server, but make sure to undo any database changes you make in the process of testing. Be exhaustive and report back with an .html report that highlights the visual issues and proposed solutions so I can review each one. Ultracode on.
Which means I have up to 10 Opus 5.5 medium agents running concurrently for long stretches of time.
I want to be clear I don't think that using Claude in this way gets you the best possible results. But when the app is fully vibecoded then audit prompts like the one above can be seen as a definite net positive. Making Claude think really hard about various improvement routines will get you better results in that one aspect than Claude's first attempt to build something from scratch did.
Is just the first hit your dealer gives away for free. Treating that as the actual baseline cost for what they need in order to justify current AI valuations requires some truly fraudulent mathematics. Hell, even the current API rates are unsustainable -as-long-as- they need to keep investing into training the next model they will be serving 6 months from now.
The plan has always been to develop these models using borrowed money, get everyone's business process addicted to them, moat off access to alternatives (e.g. chinese / foreign open-weight models), via technical superiority -or- more likely regulatory shenanigans, THEN jack the prices up through the roof starting with direct enterprise customers buying API access but then obviously bubbling down into literally every product / service every human being on this planet purchases. Unfortunately, it's a garbage plan based on a multi-ton house of cards that is about to collapse on everyone.
That is usage based and therefore expensive.
Putting everyone on their own plan is economical, if you can give those things up.
Source: I've worked in and with many successful organizations, and worked at one place with proper internal processes, so I know what's possible
I don't agree at all. Different groups should be supporting each other and the overall bottom line instead of their parochial, narrow self-interests - the latter is a poorly functioning org.
If by group A delaying its $100M cost-cutting, group B can add $1B to the bottom line, it would be a corporate and group management failure for group A not to cooperate.
So here, would they synchronize announcing big things in relation to the hottest and most risky investment there is right now?
"what motivated them to announce this a few weeks before trading starts?"
Also what’s your point? Goldman Sachs shouldn’t pull Claude Code because there’s no point in trying in this world and we should all give up on everything?
Banks have a ton of legal/compliance/reglatory/reputational concerns about application access/entitleements, data privacy, data licensing, granular data entitlements, data access (auditable).. approval chains (auditable), as well as actual financial risk.
I’ve seen the same happen with insane spreadsheets.
As empowering as something like Claude code can be, leaving development to developers means the output is inherently supported by the organization long term.
By wholly depending on the assisted coding you are wholly dependent on Anthropic, forever, for something that is now critical.
There are probably thousands of these little microscopic dependencies that occur when you make these tools widely available. What happens when you don’t want to foot the bill anymore?
It was the right choice. But many of the rough edges of the terminal do surface and confuse non technical people.
Getting there faster with less knowledge of coding isn't the problem.
Pre LLMs, the main barrier to producing software for non-tech people was writing the code, literally. With LLMs, this barrier is now gone. This results in a much larger volume of slop than before. And then the real barrier shows up -- understanding, fool-proofing and maintaining that code. Code is cheap, show me how it runs in prod.
Like it's great that quants can iterate on their ideas much faster now. But GS is saying they shouldn't leave their sandbox.
Exactly
User scripts that turn into applications that need production support are often consequential and business-differentiating since they do the things that can't be bought off the shelf and effectively encode tacit knowledge.
1) Claude Code is only being taken away from traders.
2) Only traders have permission to send orders to the market and book client trades.
3) Claude code would have been running as the trader, under their account with minimal review.
If you run a coding agent in that environment it's only a matter of time until it enters a bad order or books a bad trade, and once that happens it's only a matter of time before management decides to take this kind of action.
Goldman is definitely not doing this for cost reasons. They can afford the tokens.
Well, sure, but if the tokens aren't benefiting them enough to justify the cost it could make sense to do for cost reasons.
Wherever I've seen a pull back, it is all because of compliance or security. And that too not because of the purity of heart; but because some checkbox couldn't be ticked due to AI.
Safe means containers, guardrails, egress filters, human in the loop, deliberate per agent mcp controls, and real expertise in prompting/task selection, etc.
So far the pattern I've seen is security teams say no, it gets escalated, it's allowed, then 1% of the time the model yeets data where it's not supposed to (no amount of promoting or controls seems to really fix this), it's locked back down.
Just fyi.
The UK is very good at banking.
To be fair, UK's #1 talent and economic advantage for global commerce in 2026 is their contract law and the courts that judicate it. It is unmatched globally. Sure, New York, Paris, Tokyo, Hongkong, and Singapore are pretty big, but nothing competes with London for international contract law. The ecosystem is just so massive and concentrated in London -- courts, highly experienced judges/barristers (lawyers)/academics.
But DEFINITELY NOT Barclays.
Im not convinced it's creating any economic value at all.
Like 10% of people use it reasonably/responsibly and the other 90% basically become turbo lazy. I think I'd rather my employees be working "slow" but actually working hard and not just functioning as meat proxies for mediocre bots and reducing my workforce to some median competency.
There's no edge in using the same tools that everyone else is using, especially in markets/finance.
Let your competition all melt their brains, maybe only give employees you know are actual super contributors, (and not just mentally offshoring their work) unlimited access to llms.
If the issue is security, a much more interesting problem for the engineering team to do is design the programming environment for the bankers so they cannot hurt themselves.
If the issue a performance, designing great abstractions that the bankers' agents can use is "low code done right".
I hope the bankers rebel hard against this policy change!
There are things simple building blocks don't prevent in the event of nefarious or stupid behavior.
Imagine a nefarious banker creates an app that lets him talk to a trader on the other side of the "Chinese wall" about M&A deal flow without getting caught because they are avoiding monitored channels like email, slack, phone, zoom.
Imagine an idiot writes an app that scans his email and summarizes client information he is privy to and writes it to some database that his app then serves up to others on the trading desk. He is unaware that entitlements exist, and by giving others access to his new app he has broken them. Btw summarizing email is a HUGE use case across non-technical users in finance that they are very excited about.
Back channel conversations have been happening since forever and hardly need vibe coded apps to pull off. They can use non-corp services on personal devices, or kick it old school and grab drinks at the bar downstairs.
Thats the reason why there are companies like:
https://en.wikipedia.org/wiki/Digital_Reasoning
(funded amongst others by In-Q-Tel, the investment arm of that intelligence service)
If a trader uses their personal cell / WhatsApp / etc in today's age, all the liability falls on that trader.
If organize drinks with a coworker adhoc and communicate things they shouldn't.. the same.
However, if a trader on their work PC, on the work network, in the office can communicate in electronic form on an unsecured, unmonitored channel.. the bank is paying a very large fine. This is like leaving gmail unblocked on work computer/network.
Likewise if the bank itself organizes a monthly drinks between 2 departments on different side of the Chinese wall, offsite and things get communicated that shouldn't .. its obviously somewhat intentional by the bank and they will get fined.
Now worries! Its called the "citizen developer" today! :-D https://de.wikipedia.org/wiki/Citizen_Developer
Only select high privilege code, where we don't know how to make it "secure by construction", should depend on full audits.
The right use-case here is "custom homegrown Bloomberg Terminal add-ons", not autonomous trading software that can see everything and also isn't routed through trading risk software.
I dunno if rebellion is the right framing. Maybe pulling the organization toward their side instead. Ultimate the “bankers” at an investment company decide where the company is going, after all. Grabbing your own steering wheel isn’t rebellion.
Or just the Claude app with local execution disabled by org policy, if that’s a thing.
The “Claude can read everything” model is great for vibe coding but not suitable for regulated industries, which require more structure.
My point is mostly that there is a middle ground that can preserve some of the wins; Claude can vibe up a CMA pipeline pretty quickly. There’s likely room for an internal platform to enforce required invariants though.
> If the issue is security, a much more interesting problem for the engineering team to do is design the programming environment for the bankers so they cannot hurt themselves.
Interesting take but it doesn't compute. When engineering team teams design programming environments so that people can't hurt themselves they will be locked into a "take it or leave it" set of environments.
Also, you do know security isn't just about engineering, it is also about data right?
How do you suppose it works when bankers who have day to day access to sensitive data as part of their job - upload it to AI? What to do then? Restrict data access?
> rather than a fixed set of discreet programs "take it or leave it".
This part always amuses me. AI boosters seem to think everyone hosting their own bespoke app is the next big thing. But who manages that? Banks are not tech giants. Most engineering teams don't bring in money and headcounts are strictly managed. As the article says:
> "He told Bloomberg that traders and bankers had built tools with AI and passed them to the firm's engineers, of whom there are about 12,000, to be improved."
So, how does engineering with limited staff design a safe environment and improve 12k apps. I am sure Goldman's management wont be thrilled about increasing engineering headcount to match these expectations.
Sounds like the web platform.
> If the issue is security, a much more interesting problem for the engineering team to do is design the programming environment for the bankers so they cannot hurt themselves.
> If the issue a performance, designing great abstractions that the bankers' agents can use is "low code done right".
You do realize you're contradicting yourself right? To get to a state where "bankers cannot hurt themselves" or "low code [is] done right" is to end up right back at the "take it or leave it" programs.
Security was already addressed, by these "take it or leave it" programs.
Add enough abstractions on top of each other that must be adhered to or else it falls apart, and what do you get? "take it or leave it" programs.
This reminds me of the sovereign citizen movement that got really popular in 2019. The illusion of freedom feels great I'm sure. Until you realize you are entirely dependent on the existing infrastructure and the people who maintain it to enjoy the apparent freedom.
All this is just counter productive and drowns everyone is slop.
Claude Code is a poor fit for non-engineers, it carries a lot of features, vernacular, and patterns that don't make sense to people that don't code.
So I don't think this means much? All of the coding functionality a non-engineer could want is still available, just no need to switch to a different tab in the Claude app (or even worse the terminal).
I'm guessing that + probably the absence of any deployment infrastructure for the finance people to be forced to use made Goldman Sachs' eyes widen and pull the plug immediately before something blows up (if it hasn't already internally).
I also wonder if a lack of diligence with Claude Code (or any LLM tool for that matter) resulted in private information getting leaked, and that feedback is just now getting back to them.
In terms of the big picture of the industry and the AI bubble though, yeah this isn't too big of a deal.
Has nothing to do with AI being bad. Good engineers have a mind for it. They tend to be more detailed oriented. Understands how parts connect. Understands the pros and cons of approaches. Can see when the AI does something stupid. Probably knows a better way if the AI veers off.
We don’t ask software engineers to file Goldman Sachs yearly company taxes using just AI right without any expertise right?
We don’t ask engineers to go out and do cold calls for sales right? Engineers don’t have the mind for that. They’d suck at it.
We don’t ask sales people to write programs right? Have you met a sales person? They’re the opposite of builders. They lie, take corners to close a deal. You can’t do that building a real production system.
This hardly makes sense to me. Claude Code is an excellent tool for running your environment and augmenting your productivity. Most traders are sharp folks who could use CC to great effect I am sure. I'd be super annoyed.
1.https://www.the-independent.com/tech/chatgpt-ai-cancer-cure-...
On one end of the spectrum you've got presumably you, who brings a sketch or prototype to engineering, and has a reasonable discussion about what can or cannot be made production ready on what timeline, with what budget.
On the other end you've got people who bring a half baked prototype to a couple engineers, demand it be in production next week, and then escalate and make a big scene when there's pushback.
No engineers tend to complain about the former. The latter is stressful as hell
I never like these kinds of statements because it makes so AI can’t ever be critiqued. You can always go “well that’s a bad engineer.”
As someone who has been on the receiving end of many of these tools, I feel 'improved' is doing some heavy lifting here.
Completely overhauled to be operationally viable, perhaps.
Thrown into the dark recesses of the backlog, more likely.
Agentic engineering needs to be "all in".
You have to go all in on agentic engineering. And if you're all in on agentic engineering and doing it well, then anyone should be able to build safely and no one needs to look at code. The code should look highly consistent and agents should be enforcing best practices, approved architecture, running security scanning, etc.
The gains at the middleground compromise are not really significant and, IMO, creates frustration and friction.
Works best to go all in. GS should let everyone have CC and GH and focus on making their enterprise harness safer for everyone.
The details are very different, but variations on this theme have played out for a long time. I have seen fixed income instrument modeling systems 20 years ago that allowed Traders to put in limited C++ code to define new exotic instruments.
At least that stuff had guardrails around it.
This is gold! :-))
Looks like someone was overusing the good old <https://github.com/calvin-ll/is-even-ai>.
Jokes aside, I bet this sums up the difference between an engineer and a regular user who might just use whatever API they can find (although I concur that no single 2026 LLM would ever propose that).
is claude on the waiting list of shooting stuff going through the strait of Hormuz?
isn't goldman sachs like a caring foster step mother to big AI corps in the MSX White Label OpenAI NVIDIA Soviet?
wait, are they about to increase prices while deteriorating the current cohort of models? god damn it!
did the whole rewind on RE cause a bit of an AI getting worse cuz it cant use the best AI anymore syndrome, some inverse of AI imposter syndrome? ho-ly shit!
Apparently they finally got the memo that leaking corporate secrets for at least traders and bankers is unwise.
If you need to ask, maybe you shouldn't hand it over to non tech, high risk individuals just yet.
AI skynet has not yet won.
Also AIUI both claude[0] and chatgpt[1] offer HIPAA compliant BAA’s.
0: https://support.claude.com/en/articles/13296973-hipaa-ready-...
1: https://openai.com/solutions/industries/healthcare/
I don't think it's far fetched to say the reason the subscription discounts $1k of API to $200, is that the data is worth $800.
Is this typical behavior with LLMs not just Claude, but you can discourage from doing so by explicitly stating not to use tool or only use knowledge either in the system prompt or user prompt.
LLMs are trained to use tool if they can't solve a problem rather than guessing/hallucinating.
A dumb example is asking to count. As the range grow it'll attempt to write a script or use commands like seq to generate the numbers.
I work in healthcare-adjacent tech. You can use Claude with HIPAA/PHI. You need to sign a BAA (Business Associate Agreement). It dictates how Anthropic may use and how they must safeguard the PHI (Private Health Information), including not training on it.
I assure you that Claude and other LLMs are used extensively in healthcare, with PHI access, just about everywhere.
Don't be naive. Don't be alarmist.
If anything, LLM use under these conditions is far more safe than the way most people use LLMs. Engineers who aren't under any regulatory regime like HIPAA are using LLMs without the BAA safeguards, exposing personal data directly to the insecure, shared models, which are now training on all the personal data that's being fed into them. People think their communication with LLMs is private and isolated, but without the BAAs in use by companies under compliance regimes, it's not isolated.
To me it’s the phrasing “I got her using Claude code”. Maybe that means “I helped her set up access through her employer approved AI account” but it’s not exactly that common for such access to be set up by your husband. It just as plausibly means “she’s using the same personal account she’s using for the family tasks I also mentioned”. I don’t see that concern as naive so much as in tune with the way people frequently use tech.
If it's some other corpo-acronym, I would hope you would define the term before unleashing it on us normies.