Replit CEO Amjad Masad is warning that AI coding agents running on employee devices are becoming a security risk for enterprises and governments, as financial institutions begin restricting access to tools such as Claude Code.

“AI agents running on employee endpoints are becoming a systemic security risk for enterprises & governments,” Masad writes on X, Tuesday. “Some are responding by restricting tools like Claude Code, as Goldman Sachs reportedly has.”

“Some are responding by restricting tools like Claude Code, as Goldman Sachs reportedly has.”

His comments follow a Bloomberg report that Goldman Sachs has restricted access to Anthropic’s Claude Code and Microsoft’s GitHub coding tools to engineers. The restrictions apply to bankers and traders, but certain quantitative employees known as strats are exempt.

Goldman spokesperson Nick Carcaterra told Bloomberg the bank weighs productivity gains against potential risks when deciding which employees can continue using AI tools.

“This is widespread in finance. The ban hammer is coming down,” he writes, responding to a post about the bank’s restrictions.

When asked what was driving the crackdown, Masad points to “Supply chain attacks etc.”

Running coding agents directly on employee machines raises concerns about credential exposure, malicious instructions and compromised dependencies, each of which has already surfaced well beyond the finance sector.

The credential question has been pushing vendors toward short-lived tokens for months, a shift Vercel recently forced on its own suppliers by setting a deadline to abandon the long-lived keys that an agent operating on an endpoint could quietly read and reuse.

Source link