It's wild that I get blog posts from the pragmatic engineer how everyone in OpenAI uses codex to do their job. As far as I know, the lethal trifecta isn't solved. Codex doesn't integrate DLP controls to block or filter exfiltration of sensitive information. The sandbox of these tools is poor at best. We can't easily control what data they can access, or websites, etc.

How can any company, let alone a regulated entity like a bank run these tools? I mean, they are really powerful and I can see the productivity they can provide, but the risks are not being effectively managed. The other day I saw the term vibe-accounting. If that doesn't scare you, nothing will. No-one seems to care. Goldman Sachs is the first major to take serious steps to manage the risk. I expect to see more of this.