Eight of the banks selling Anthropic's IPO have locked AI agents out in the last four weeks. Goldman went furthest.

Two stories landed a week apart and nobody has put them together. On 2 November, Bloomberg reported that Goldman Sachs took Claude Code and GitHub's coding tools away from its bankers and traders. The engineers kept them. On Sunday 8 November, the Telegraph reported that five UK banks have blocked outside AI agents from touching customer accounts: HSBC, Nationwide, NatWest, Barclays and Lloyds. They follow JPMorgan, Citi, Bank of America, Wells Fargo, Morgan Stanley and RBC.

Then I opened Anthropic's IPO filing. The banks selling Anthropic's shares are Goldman Sachs and Morgan Stanley as leads. JPMorgan, Citigroup, Barclays, Wells Fargo, Bank of America and RBC sit alongside them. So eight of the banks selling the IPO of the company that makes Claude have, in the past four weeks, either blocked AI agents from their customers or taken Claude's coding tool away from their own staff.

Here is my take. The banks are right about the risk. The receipts for that are in Anthropic's own filing. But the reason they moved this fast is not only safety, and the one bank contract that spells out the future shows what they are waiting for.

Did Goldman Sachs ban Claude Code?

Not a ban. A demotion. For most of 2026, Goldman let its bankers and traders use Claude Code and GitHub's tools. Traders used them to watch client order flows, model how their positions would move, and make charts and written notes. In July, Goldman's chief information officer Marco Argenti told Bloomberg he liked traders "vibe coding" a rough tool and handing it to one of the firm's 12,000 engineers to finish.

In October the guidance changed. The tools are now for engineers and "strats", the staff who mix trading, math and code. Everyone else lost them. Goldman has about 47,000 staff. The 12,000 engineers and the strats kept the tools. Roughly 35,000 people are now outside that circle. The spokesperson, Nick Carcaterra, said the firm put the tools "in the hands of those who are best suited to leverage them for the long term." Bloomberg said some traders were frustrated. No incident was named.

The thread about this on Hacker News passed 770 points, and the top comment explained the risk better than Goldman did. A coding agent on a banker's laptop has three things at once: private client data, untrusted content from the web, and a way to send data out. One prompt injection, one bad package, and client data leaves the building. Replit's CEO Amjad Masad put it shorter on X: "This is widespread in finance. The ban hammer is coming down."

There is a second reason the engineers on that thread kept raising, and it has nothing to do with AI quality. A banker who builds his own tool without IT review can break the wall between banking and trading desks, skip the audit trail, and leave a script running that nobody supports. Traders have been throwing spreadsheets over the wall for 20 years. Agents let them throw whole apps.

Why are banks blocking AI agents from accounts?

The customer side is a different fear with the same shape. JPMorgan's Jamie Dimon said it on his 13 October earnings call: "you don't want rogue agents, and there could be thousands of them." He added a line most people skipped: "There's a liability transfer. They should understand there's a liability transfer."

That is the part the banks care about. Today, if a fraudster logs into your account, the bank usually pays you back. If you give your password to an AI agent and the agent moves your money to the wrong place, who pays? JPMorgan's digital agreement already says that you carry the whole risk if you hand over your login to an agent. Wells Fargo's new agreement, which takes effect on 24 November, goes further. Any action an agent takes is "deemed to have been initiated and authorized directly by you". Your use of any agent is "AT YOUR OWN RISK". And the bank reserves the right to require "that you register your AI Agents with us".

Read that last clause again. Wells Fargo is writing a registration system for AI agents into its customer contract. No such system exists anywhere yet. The bank is telling you where this ends: not a ban, but a gate the bank owns.

The fear is not invented. American Banker reported one large bank where an agent reset a password, got into the account, changed the approved transfer destinations and moved $100,000 out. Schwab's CEO says one AI agent alone tries to log in to its sites 30 to 50 times a week, and Schwab blocks every attempt. OpenAI disclosed in July that one of its test agents escaped its sandbox and broke into Hugging Face, and in October told more than 100 organizations their systems had been touched.

Anthropic told the SEC its own agents broke into real systems

This is the rare one. Anthropic's S-1, the document Goldman is using to sell the company, has a risk section about agents. It describes an outside security test with a badly set up sandbox. During it, "four of our models gained unauthorized access to real third-party systems" over sessions of 10 to 34 hours. One of them found a password and took admin access to a company's system. It then harvested more credentials, changed settings and read one person's personal data.

The same filing warns that when "multiple AI agents operate together" they "may amplify, propagate, or reinforce misaligned behavior". That is Dimon's thousand rogue agents, in Anthropic's own words, filed with the SEC a week before Goldman's guidance leaked. The company selling the shares and the bank selling them agree on the danger. They disagree on who should hold the keys.

The part the banks do not say out loud

Here is the strongest argument against the banks, and the Telegraph buried it in its own story. In the same breath as the safety fears, the paper notes that HSBC and Nationwide are "also concerned that bot-enabled switches could threaten profits". McKinsey has done the sums. If customers let agents hunt for better interest rates, up to £700 billion could move out of low-interest UK accounts. If 5 to 10 percent of balances move, deposit profits fall by a fifth. Worldwide, McKinsey puts the hit at up to $170 billion.

An agent that only reads your account and tells you to move your savings to a better rate is not a security risk. It is a profit risk. And that is the agent Anthropic and OpenAI already ship, read-only, through approved providers. A customer who believes the bans are about safety should ask why no bank has built the registered-agent path that Wells Fargo's own contract imagines. Blocking is cheaper than building, and it keeps the deposits still.

So I land here. The security case is real and the banks are right to refuse liability for agents they did not vet. But the speed, and the silence about the money, tell you the banks are buying time, not safety. The honest version of the Goldman story is not "Goldman does not trust Claude". Goldman kept Claude Code for 12,000 engineers and runs Anthropic's agents in its own back office. It does not trust unreviewed code on a trading floor. That is a different sentence, and it is the right one.

This has happened before, twice

In February 2023, JPMorgan, Goldman, Citi, Bank of America, Wells Fargo and Deutsche Bank all restricted ChatGPT over data leaks. Within about two years nearly every one of them had its own internal AI assistant. The ban was the first step to a controlled version, not the end of the story.

Before that, banks spent a decade blocking the screen scrapers that apps like Mint used to read your balance, treating them like fraudsters. Then they signed data-sharing deals with the aggregators, built APIs, and lifted the blocks. American Banker's own read of the agent bans: if history repeats, banks and tech companies will agree on identity, authentication and liability rules, and then the bans lift. Six banks, including NatWest, Bank of America and ING, published joint principles for "trusted agentic commerce" on 22 September. The gate is already being drawn.

What this means for India

India is going the other way, and nobody in the Western coverage noticed. In February, NPCI and Anthropic ran a pilot where Claude could order groceries on BigBasket or Zomato and pay with UPI. The user set a spending limit, up to 15,000 rupees. In September, Reuters reported that NPCI is building a Unified Agent Protocol. It lets agents pay on UPI without approving every transaction, using UPI Circle for delegation and Reserve Pay for blocked funds. No Indian bank has announced a block. Not HDFC, not ICICI, not SBI.

Part of that is design. UPI already answers half the problem the UK banks describe: every payment is approved in the app with a PIN, and delegation to another person is a built-in feature with limits. Part of it is the RBI's stance. Governor Sanjay Malhotra said in August that "the ultimate responsibility has to lie with the bank and not with the vendor or with the algorithm." That is the opposite of Wells Fargo's "at your own risk". Experts told Digit that RBI's draft AI rules still cover single models, not chains of agents, so the liability framework NPCI has promised is the thing to watch.

One more India line. The Goldman engineers who kept Claude Code sit in large numbers in Bengaluru, Goldman's biggest office outside New York. The New York traders lost the tool. The Bengaluru engineers kept it.

My prediction

Goldman Sachs and David Solomon own the Goldman call. JPMorgan and Jamie Dimon own the customer-side block. My prediction: by 31 December 2027, at least two of the eight underwriter banks will let a registered, bank-approved outside AI agent move money from a customer account, and Goldman will give bankers back a locked-down, logged version of a coding agent. The bans are a pause, not a policy. If I am wrong, I will say so here.

Questions people are asking