Short answer: Most companies don’t need a ban. They need a clear AI tool policy. Goldman Sachs restricted Claude Code and GitHub Copilot to engineers in October 2026, citing productivity and risk management. Whether you should do the same depends on three things: what data your staff touch, whether AI-built tools reach customers, and whether anyone reviews the code.
Summary
Goldman Sachs limited advanced AI coding tools to engineers in October 2026, reversing its July enthusiasm for staff “vibe coding”.
The problem is rarely the tool. It’s unreviewed AI-built code touching real data with no owner.
A simple three-tier policy (explore, build, ship) keeps the productivity and removes most of the risk.
Non-engineers can keep prototyping safely, as long as nothing reaches customers or production data without an engineer’s review.
You can put a policy like this in place in about two weeks.
In this article
What did Goldman Sachs actually change?
Why would a bank pull AI coding tools from its own staff?
Should your company ban vibe coding for non-engineers?
What does a good AI tool policy look like?
How do you roll out an AI tool policy without killing momentum?
Common mistakes companies make with AI coding tools
FAQ
What did Goldman Sachs actually change?
Goldman Sachs restricted most traders and bankers from using advanced AI coding tools, according to internal guidelines from October 2026 reported by Bloomberg on 2 November. The tools named were Anthropic’s Claude Code and Microsoft’s GitHub Copilot. Engineers keep access.
A Goldman spokesperson said the decision reflected “a variety of factors including productivity and risk management”. He added that the experimentation phase is over, and the tools now go to the people “best suited to leverage them for the long term” (The Decoder, citing Bloomberg, November 2026).
The reversal is notable. In July 2026, Goldman’s CIO, Marco Argenti, publicly praised vibe coding by non-technical staff. Vibe coding means describing what you want in plain language and letting an AI write the software.
Why would a bank pull AI coding tools from its own staff?
A bank pulls AI coding tools when the risk of unreviewed code outweighs the time saved. Goldman didn’t publish a detailed reason, but the risks are well documented elsewhere.
Security issues multiply. Apiiro’s research into Fortune 50 companies found AI-assisted engineers were about four times more productive, but produced ten times the security issues (reported by Engadget, November 2026).
AI tools themselves are being attacked. In October 2026, a fake Claude Code extension sat in Cursor’s marketplace for about 11 hours, and up to 5,000 users may have been affected (Anadolu Agency timeline, October 2026).
Nobody owns the result. A spreadsheet macro built by a trader at 11pm has no tests, no documentation and no one responsible when it breaks.
For a regulated bank, any one of these is enough to pause. Together, they explain the move.
Should your company ban vibe coding for non-engineers?
Most mid-size companies should not ban vibe coding outright. A ban pushes the work underground, where people use personal AI accounts with no oversight at all. That’s usually worse than the risk you were trying to remove.
A ban makes sense in a few situations:
Situation | Our recommendation |
|---|---|
Staff handle regulated data (financial, health, personal) | Restrict building to engineers; allow AI chat for drafting only |
AI-built tools would reach customers | Require engineer review before anything ships |
Internal prototypes on test or public data | Allow, with basic rules |
Personal productivity (formulas, scripts, summaries) | Allow, with approved tools only |
The question isn’t “AI or no AI”. It’s “who is allowed to ship what, and who checks it”.
Not sure where your team sits? Type B Digital runs short AI readiness reviews for mid-size companies. Book a 30-minute call and you’ll leave with a clear view of your risks.
What does a good AI tool policy look like?
A good AI tool policy splits work into three tiers, so people know exactly what they can do without asking. Here’s the structure we recommend to clients.
Tier | Who | What’s allowed | Rules |
|---|---|---|---|
1. Explore | Everyone | Ask AI questions, draft text, build throwaway prototypes | Approved tools only. No customer or confidential data. |
2. Build | Trained staff and engineers | Internal tools used by your own team | Code stored in your company repository. One named owner. Light review. |
3. Ship | Engineers only | Anything customers use, or anything touching production data | Full code review, security scan, testing, monitoring. |
Every tier also needs four basics:
An approved tools list. Name the AI tools staff can use, on company accounts, not personal ones.
A data rule. Spell out which data can go into AI tools. “Nothing with customer names, account numbers or health details” is clear enough.
A secret rule. No passwords or API keys (the codes that connect software to services like OpenAI) pasted into AI chats or code.
An owner for every tool. If it breaks, one named person fixes it.
How do you roll out an AI tool policy without killing momentum?
You roll out an AI tool policy by starting with what people already do, not with a rulebook. Most teams can have a working policy in about two weeks.
Week 1, find out what’s in use. Run a quick survey: which AI tools do people use, for what, and with which data? You’ll usually find more than expected.
Week 1, sort the use cases into the three tiers. Most will land in Explore or Build.
Week 2, pick approved tools and set up company accounts. Central accounts give you logs, billing control and the ability to switch access off.
Week 2, publish a one-page policy. Keep it short enough that people actually read it.
Ongoing, review every quarter. AI tools change fast. Your policy should too.
Common mistakes companies make with AI coding tools
These are the mistakes we see most often:
Banning everything. People switch to personal accounts, and you lose all visibility.
Allowing everything. AI-built tools quietly end up handling customer data with no review.
No owner. The person who built the tool leaves, and no one knows how it works.
Treating prototypes as products. A demo that works for one user often breaks with a hundred.
Ignoring the tools themselves. Extensions and plugins for AI coding tools can carry malware, as October 2026 showed. Only install from verified publishers.
FAQ
What is vibe coding? Vibe coding is building software by describing what you want in plain language and letting an AI tool write the code. Tools like Claude Code, GitHub Copilot, Cursor and Lovable make it possible for non-engineers to build working apps quickly.
Did Goldman Sachs ban AI completely? No. Goldman Sachs restricted advanced AI coding tools, specifically Claude Code and GitHub Copilot, for most traders and bankers. Engineers can still use them. The change was reported on 2 November 2026.
Is vibe coding safe for business use? Vibe coding is safe for prototypes and internal experiments on non-sensitive data. It becomes risky when AI-written code reaches customers or production data without review. Apiiro’s research found AI-assisted teams produced ten times the security issues.
Should non-engineers be allowed to use AI coding tools? Non-engineers can use AI coding tools for exploring and internal prototypes. Anything that customers use, or that touches real company data, should be reviewed and shipped by engineers.
How long does it take to create an AI tool policy? Most mid-size companies can create a working AI tool policy in about two weeks. Start with a survey of current use, sort it into tiers, approve tools and publish a one-page policy.
What should an AI tool policy include? An AI tool policy should include approved tools, rules on what data can be shared, a ban on pasting secrets, tiers for who can build and ship, and a named owner for every AI-built tool.
Keep the speed, lose the risk
Goldman’s move isn’t a sign that AI coding tools have failed. It’s a sign the experimentation phase is ending, and companies now need structure around who builds and who ships.
Type B Digital is a technology consultancy that helps companies put AI to work safely, from AI policies and readiness reviews to turning prototypes into production-grade products. Book a 30-minute call. You’ll leave with a clear picture of your AI risks and a practical next step.
Sources
The Decoder: Goldman Sachs pulls AI coding tools from traders and bankers (2 November 2026, citing Bloomberg)
Bloomberg Law: Goldman restricts traders and bankers from using some AI tools (2 November 2026)
Engadget: 5 safety practices to know before vibe coding (1 November 2026, citing Apiiro research)
Anadolu Agency: Timeline of the October 2026 cyberattack wave (October 2026)
