12,000 engineers kept Claude Code. Bankers lost it

12,000 engineers kept Claude Code. Bankers lost it Goldman Sachs restricted Claude Code and GitHub Copilot to its roughly 12,000 engineers in October, ending months of banker and trader "vibe coding" — and the bank announced it four days after a backdoored Claude Code extension reached up to 5,000 Cursor users. The bank's stated reason was "productivity and risk management." The calendar says which half did the work. What Goldman actually did Bloomberg reported on November 2, 2026 that internal guidance updated in October limits Anthropic's Claude Code and Microsoft's GitHub coding tools to Goldman's engineers. Traders, bankers, and most other staff lost access to tools they'd been using for months — to monitor client trading flows, build analytical material, and model changes in markets and positions. One group kept access besides the engineers: the "strats," Goldman's hybrid quant-researchers who write production code as part of the job. Goldman spokesperson Nick Carcaterra framed it as the end of an experiment, not a retreat: "After a period of experimentation where we assess a variety of factors including productivity and risk management, we put them in the hands of those who are best suited to leverage them for the long term." That is a careful sentence, and the careful word is "experimentation." In July 2026, Goldman CIO Marco Argenti was publicly praising the opposite arrangement — a trader or asset manager gets an idea, builds a quick prototype with AI, and hands it to one of the bank's engineers to scale for production. Three months later, the prototype stage itself was restricted to engineers. The bank didn't say the tools failed. It said the wrong people were holding them. This wasn't Goldman's first AI restriction of the year, either. In April, it removed Claude from its internal AI platform for bankers in Hong Kong, after determining its agreement with Anthropic didn't cover use in the territory. The April restriction was about location and contract terms. The October one is about role: who is allowed to produce code, not where they sit. Four days earlier, the same tool was poisoned On October 29, 2026, tampered builds of Anthropic's Claude Code extension — versions 2.1.312 and 2.1.313 for Windows and macOS — sat in Cursor's extension marketplace for about 11 hours, from roughly 2:27am to 1:35pm PT. Cursor says at most 5,000 users received them. The payload appended an attacker SSH key labeled svc-telemetry to ~/.ssh/authorized_keys, installed persistence that survives uninstalling the extension, and tried to open a reverse SSH tunnel to 134.209.82.225. A clean 2.1.314 shipped on October 30. Anthropic says it neither built nor published the tampered versions; Cursor took the marketplace offline, rotated keys, and rebuilt it. I am not claiming the incident caused Goldman's decision — the guidance was updated in October, and Bloomberg reported it on November 2, four days after the incident. But put the two events side by side and the bank's phrase "risk management" stops sounding abstract. The concrete version of that risk is: the tool your traders use to write code can itself be replaced, at the marketplace, with a version that plants an SSH key on their laptops — and uninstalling it doesn't remove the key. Goldman has 12,000 engineers to hand the tools to. It does not have 12,000 bankers it can ask to audit their authorized_keys. The underwriting irony There is one more detail in the reporting, and it's the one that makes the story stick. Goldman Sachs and Morgan Stanley are lead underwriters on Anthropic's IPO — the S-1 was filed October 26, 2026, with Anthropic expected to list on Nasdaq under the ticker ANT before the end of November. So the bank that is taking Anthropic public is, in the same month, telling its own bankers they may no longer use Anthropic's coding tool. That is not a contradiction. It is the whole point: Goldman is happy to sell you the company, and it is also happy to tell you that inside a bank, the question isn't whether the tool is good. It's who is allowed to produce code that touches client money. The line Goldman drew Every enterprise AI policy eventually draws this line, and Goldman's is unusually legible. It isn't "AI is banned" — the engineers kept everything, and the strats kept everything. It isn't "AI is safe" — the bankers lost the tools they'd been using for months. The line is: the person who produces the code has to be the person whose job it is to own it. A trader's prototype that monitors client flows is code that touches client data whether or not anyone calls it production. A banker building market models in an agent is writing software that influences decisions, and when that software is wrong, "the AI wrote it" is not an owner. That's a defensible line, and it's also a narrow one. It holds exactly as long as the engineers stay the bottleneck — 12,000 of them, in Goldman's case, which is a luxury most companies don't have. For a firm with 200 engineers and 2,000 everyone-elses, the same policy is just a ban with better PR. And the policy says nothing about the supply chain underneath: the engineers still install the same extensions from the same marketplaces. The October 29 incident hit engineers too — the 5,000 users who got the tampered build were developers. Restricting the tool to engineers doesn't fix a poisoned marketplace. It just makes sure the people holding the poisoned tool are the ones who know what ~/.ssh/authorized_keys is. Sources: Bloomberg, November 2, 2026 (via FinanceFeeds, Meridian Report, AI Tool Briefing); Cursor security notice on the Claude Code extension, October 29–30, 2026; StepSecurity, "Trojanized Claude Code Extension Delivered Persistent SSH Backdoor to Developer Machines," October 30, 2026; Phorion teardown, October 2026. The Goldman quotes are the spokesperson's words as reported by Bloomberg. The Anthropic IPO underwriting detail is per the S-1 filed October 26, 2026, as reported. I did not independently verify the internal guidance — Bloomberg's reporting is the source.