AI Governance Institute
← News
Corporate Policy2026-11-08

Goldman's Claude Code Ban Exposes AI Coding Tool Governance Gap

What happened

In October 2026, Goldman Sachs updated its internal guidance. It removed access to Goldman Sachs Is Pulling Claude Code From Its Bankers and Traders for all staff outside its engineering function. Traders and bankers had used Claude Code and GitHub Copilot to build market models and monitor client flows, tasks that generated code running directly on machines handling client information. The internal review flagged two risks: unreviewed code on systems holding sensitive client data, and AI coding tools blurring information barriers between deal-side bankers and traders. Those barriers are a core compliance requirement in financial services, designed to prevent conflicts of interest and misuse of non-public information. The reversal was notable because Goldman's chief information officer had praised trader-built AI tools as recently as July 2026. The policy change signals that internal risk assessments are now overriding business-unit enthusiasm.

Why it matters

  • ·Financial services firms face regulatory exposure when AI coding tools allow non-engineers to generate unreviewed code on systems that hold client data. Regulators examining information barriers and model risk now have a named example of the failure mode to point to.
  • ·Information barriers are a legal obligation in investment banking, not just a best practice. AI coding agents that allow deal-side bankers and traders to share tooling or data context can compromise those barriers and create securities law risk.
  • ·The reversal of a publicly praised practice within months shows that business-unit adoption of AI tools can outpace governance review. Organizations that have not audited which staff have access to AI coding agents, and what those agents can touch, face the same exposure Goldman found during its review.

Stay ahead of stories like this

Get every Global AI governance development like this one, plus the rest of the week's developments. Every Thursday.

Free every Thursday. Unsubscribe anytime.

Governance controls affected

SEC-002AI System Access ControlsPRC-016AI Developer Tool Data Boundary ControlsHOC-001AI System Risk ClassificationCHM-002Model Deployment Gate ProcessAGT-001Agent Permission Boundaries

What to do now

  • ☐Pull a list of every staff member with active access to AI coding tools such as Claude Code or GitHub Copilot, and confirm whether any are outside engineering functions such as trading desks, investment banking, or client-facing roles.
  • ☐Ask your compliance and legal teams whether your information barrier policies explicitly cover AI coding tools, including whether a banker and a trader using the same AI coding tool on the same client account would trigger a barrier review.
  • ☐Confirm with your engineering team whether code generated by AI tools in non-engineering contexts goes through any review before it runs on systems that hold client data, and document the answer for your next audit.
  • ☐Review your AI tool procurement and access approval process to determine whether business-unit leaders can grant AI coding tool access without a compliance or risk sign-off.
  • ☐If your organization has publicly or internally endorsed broad AI coding tool access, assess whether that position still holds given the risks Goldman's review identified, and brief leadership on any change to your posture.

What to watch next

Financial services regulators, particularly those focused on model risk management and information barrier integrity, are likely to treat Goldman's reversal as a reference point in examinations. Firms should monitor whether the Interagency Revised Guidance on Model Risk Management (OCC Bulletin 2026-13, SR 26-2) is applied to AI coding tools by examiners. They should also watch for supervisory or guidance letters addressing non-engineer use of agentic coding tools. Whether AI coding agents require the same change-control oversight as traditional software tools remains unsettled. Guidance from FINRA or the SEC on information barrier compliance in an AI-assisted environment has not yet appeared.

Related Coverage

Research2026-11-02

Miasma Campaign Exposes AI Coding Config Files as an Unreviewed Attack Surface

In June 2026, attackers planted malicious instructions inside a Microsoft repository's AI coding assistant configuration file to harvest developer credentials without modifying any application source code. A subsequent October 2026 analysis by StepSecurity found the malicious commit used a flag to bypass automated pipeline checks and a backdated timestamp to evade detection. Most enterprises have not extended their code review and change-approval requirements to cover these configuration files.

Corporate Policy2026-11-04

$6.34 Billion Binance Heist Makes Internal AI Tools a Privileged Access Risk

Binance published an incident report tracing a $6.34 billion theft to a North Korean state-sponsored campaign that compromised three engineers through a fake job interview and malicious coding assignment. Attackers then used access to an internal AI tool to move laterally to a privileged wallet signing service. Binance has rebuilt affected systems and committed to independent security reviews.

Corporate Policy2026-11-02

OpenAI's Biology Model Is Classified High-Risk. Applicants Must Prove Their Own Controls.

OpenAI published the [GPT-Rosalind-6 System Card Addendum](https://deploymentsafety.openai.com/gpt-rosalind-6) on October 30, 2026, for a frontier reasoning model specialized in biology, drug discovery, and translational medicine. The model carries a High capability designation under OpenAI's internal Preparedness Framework for biological and chemical risk. Access is limited to qualified researchers whose own governance practices and security controls pass a trust-based review conducted by OpenAI.