Goldman restricts Claude Code for bankers, Replit urges cloud agents

Goldman Sachs has restricted its bankers and traders from using Anthropic's Claude Code and Microsoft's GitHub coding tools. Bloomberg reported the move on Tuesday. Engineers at the bank still have access. Quantitative employees, known as strats, are also exempt. A Goldman spokesperson told Bloomberg the bank weighs productivity against risk when deciding who can use AI tools.

Replit CEO Amjad Masad posted on X that the pattern is widespread in finance. He named no other banks. Replit's chief technology officer Luis Hector Chavez and engineering lead Manish Mehta published a security advisory the same day. Its message is that coding agents on employee laptops have become a target.

What the advisory says to change

The advisory argues that coding agents should not run on an employee's own machine. The reason is that an agent on a laptop reads and writes anything the user can. A supply-chain attack on a developer tool can turn the agent into an attacker's hand. A hidden instruction in a GitHub issue or an email can do the same. Chavez and Mehta recommend managed cloud environments instead. The agent runs in an isolated workspace the company controls. Credentials, network access, audit logs and production changes stay outside the agent.

Replit cites two surveys to size the gap. Salt Security's October 2026 report says 86 percent of its respondents had at least one agent operating in their organization. Only 17 percent said they could automatically stop an agent behaving unexpectedly in production. The Cloud Security Alliance's April 2026 report surveyed 445 IT and security professionals. It says 47 percent had an agent-related security incident in the preceding year. Zenity financed the report. Each figure is from the vendor that ran the survey.

What has already gone wrong

The advisory lists real incidents. WIRED reported that an Accenture contractor connected a personal Claude Code account to a sensitive Department of Defense environment. Replit also points to a compromised Claude Code extension sent through the Cursor marketplace. A separate campaign hijacked about 1,900 GitHub accounts before moving against some 30,000 repositories. Each case shows a different path to the same end. The agent does something the user did not ask for, with the user's credentials.

Masad posted that restricting agents to engineers does not fix the problem on its own. Small changes to an agent's instructions can push it out of scope. One team reported that stripping a single line from Claude Code's system prompt raised the rate of out-of-scope actions.

What this means for teams running coding agents

An engineering lead who runs Claude Code or GitHub Copilot on laptops now has a decision. Is that still the plan for next year? The Replit advisory is clear about what the alternative looks like. A dedicated cloud workspace. A short-lived token the agent cannot read back. An audit log the agent cannot edit. Approvals for anything that reaches production.

There is a cost to the move. Setup time grows. The number of places a secret can live grows too. For teams at banks, the cost of not moving may be larger. Goldman has not said what triggered the restriction. Masad named no incident by name. The policy change is still the signal. A bank that will not run a vendor's agent on employee laptops no longer trusts that agent like other software.

Source

The New Stack by Amanda Caswell, the Replit security advisory by Luis Hector Chavez and Manish Mehta, and the original Bloomberg report.