ByteDance tightens access to Claude and Codex, restricting employee use of external AI tools

Despite growing discussions about artificial intelligence (AI) in the modern workplace, most financial institutions use this technology significantly less often than companies in the broader business sector.

According to a study by Kaspersky, a global cybersecurity and digital privacy firm, only 23% of banking, financial, and insurance (BFSI) companies are applying AI for software programming. This figure is substantially lower than the industry average of 34%, representing an 11 percentage point lag.

This gap indicates that while major technology providers actively promote generative coding assistants such as Cursor and GitHub Copilot, financial institutions exercise much greater prudence, and this has serious justification.

Operational stakes in the financial sector are much higher than many outside this sphere might appreciate. A single software failure deployed in high-frequency trading pipelines or core ledgers can trigger catastrophic system failures, serious capital calculation errors, or critical regulatory breaches.

Technical concerns are compounded by a widespread management issue: 37% of BFSI executives surveyed indicated that employees use unauthorized tools—including public models like ChatGPT or DeepSeek—as a frequent and persistent risk. This percentage significantly exceeds the global industry average of 30%.

In practice, this means an engineer or analyst might turn to an external, unauthorized AI platform outside the enterprise's controlled architecture, instantly creating serious risks for confidentiality and disclosure of sensitive financial or proprietary client data. Such unauthorized use effectively bypasses enhanced defensive barriers, rendering formal perimeter controls and compliance protocols obsolete.

Meanwhile, while industry discourse remains heavily focused on automating legacy coding tasks and reducing routine costs, Paul Banting, co-founder of growthguru.ai, warns that operational efficiency alone is insufficient to serve as the primary corporate objective.

Banting explained: 'Approximately 79% of executives expect AI to drive significant revenue growth by 2030, up from the current 40%. However, only 24% have a clear idea of where this future profit will originate. The true goal should be implementing AI to identify urgent commercial gaps and capture high-value market opportunities before competitors do.'

Users have reported that the artificial intelligence assistant Claude has started interrupting tasks related to the reverse engineering of software and firmware. The complaints are concentrated on Claude Opus 5.5, the version released in September with improvements in programming capabilities, and cover analyses of games and attempts to modify smart TV systems.

These complaints gained prominence after being posted on Reddit, indicating that the model may start an activity and stop it midway through the response as soon as it triggers a security check. Anthropic has not confirmed any targeted changes for this type of use.

Reverse engineering consists of the ability to inspect a program to understand its functioning, even without access to the original source code. This methodology is used in security investigations, compatibility testing, and creating modifications.

Some reports involve REA (Reverse Engineer Anything), an open-source project that integrates AI agents with analysis tools, automating steps that would normally require technical knowledge and manual effort. Interest in this technique has also increased due to projects that use AI to recompile games to run on different platforms, including browsers.

A detailed example was presented by Decrypt. A user asked Claude Code to implement an alternative interface on an LG TV running the webOS operating system. During the process, the user encountered a security barrier imposed by Opus 5.5. The assistant suggested switching to Opus 4.8, but this older model also stopped steps in the procedure.

This incident does not prove that TV reverse engineering is completely blocked, but rather that security filters can interfere with certain technical tasks. Anthropic had already strengthened its cybersecurity protections upon the launch of Claude Opus 5.5. In its official statement, the company assures that development and code correction activities remain permitted, and to date, there is no proof that Anthropic has formally prohibited the entire practice.

Artificial intelligence is revealing the extreme fragility of web infrastructure. Although vulnerabilities have existed for over a decade, researchers have managed to understand how hackers can exploit them using AI.

A vulnerability called P2PShell affects the language code that powers seventy percent of global websites. This vulnerability allows attackers to remotely execute code or gain access to data stored on servers. As a result, sites were forced to urgently update their systems, with some government websites in Europe temporarily going offline last week until patches were installed.

This discovery once again highlights the vulnerability of internet infrastructure. Since AI enhances the capabilities of both researchers and malicious actors in discovering flaws, such discoveries are likely to continue.

Patrick Fussell, Global Head of Adversary Simulation at IBM, noted that a significant portion of the internet and global IT infrastructure runs on rather old technologies or is based on very old computer hardware, which likely has similar vulnerabilities.

With a vulnerability like P2PShell present, users have limited options for self-protection. The responsibility for updating services with the latest security patches lies with organizations, businesses, and governments.

Nevertheless, this emphasizes the need for a sensible approach to digital habits. The old advice about password protection and vigilance regarding suspicious emails is becoming more important as hackers acquire increasingly sophisticated tools and use AI to find weaknesses on the internet.

Do not ignore software notifications on laptops or phones, as many updates contain critical security fixes, and installing them as quickly as possible reduces the time hackers can use to exploit errors.

Gang Wang, an assistant professor of computer science at the University of Illinois, stated that users still need to do their part by installing updates and maintaining good security hygiene to be in a slightly better position.

Most modern smartphones support software updates for about seven years after release. If you have an old phone, you should check its compatibility with new software versions. Compatibility information can be found on the Apple, Google, and Samsung websites.

It is important to pay attention to the URLs of visited sites and clicked links, especially if the link was received via email or message supposedly from your bank or credit institution. Never provide personal data, email addresses, passwords, banking information, or credit card numbers unless you are certain of the site's legitimacy.

AI has enabled attackers to create complex phishing attacks that are harder to detect and may lack obvious signs of fraud. Previously, Jude Dressler, head of the operational risk center at cyber insurance firm Resilience, told CNN that the traditional way to identify a phishing attack was that 'something felt wrong. They used incorrect language. There were spelling mistakes, grammatical errors.' However, according to him, 'AI will do all of that.'

Dressler added that AI can also help attackers conduct deeper research on potential targets to create more personalized and convincing messages. The best way to avoid phishing scams is to log into your account or call the company or person from whom you received the suspicious message instead of clicking on links.

It should also be remembered that small businesses may update their systems slower than large companies in the event of an attack or data breach.

Never reuse passwords. Instead, try using a password manager that generates long, unique passwords for all your online accounts. Simply put, computers are better than people at creating hard-to-guess passwords.

Rachel Toback, CEO of cybersecurity and training company SocialProof Security, reported on the CNN podcast Terms of Service with Claire Duffy in 2024: 'We know that people, when making decisions, tend to make the same decisions as other people. So, you know, they create a password for their job. It has the job title. The first position has a capital letter to satisfy the uppercase requirement.'

Toback recommended password managers such as Bitwarden, 1Password, and Dashlane. The most important thing to note is the presence of encryption in the password manager, which keeps your passwords safe and unreadable to hackers.

Use access keys instead of passwords: Access keys are digital credentials that allow you to log into online services using a fingerprint, facial scan, or PIN instead of a typed password. Access keys are considered generally safer than passwords because they are tied to biometric data stored on your device, which cannot be easily stolen or forged. Apple, Google, and Microsoft operating systems support access keys.

Use two-factor authentication: Activate two-factor verification on any service that offers it. Two-factor authentication sends a login code via text message, email, or phone call as an additional layer of protection beyond the password. Some experts prefer app-based code generators, such as Google Authenticator, because text messages can be vulnerable to hackers.

Monitor all your important accounts: Keep an eye on all important accounts for suspicious changes. Many of them offer automatic email or text message alerts.

Freeze your credit report: Freezing your credit file with the three major agencies—Experian, Transunion, and Equifax—is a simple way to prevent attackers from attempting to open new accounts in your name.

Create a family codeword: If you receive a suspicious call or message from someone who sounds like a close relative and asks for information, call them yourself or call people close to them if you cannot reach them. A codeword known to you and your loved ones can confirm their identity.

Although AI facilitates even novice hackers in conducting more advanced campaigns, ultimately attackers are still trying to exploit the human factor. Dressler noted: 'It's still a familiar attack method. AI is just used to make it more plausible and effective.'