UK Government Code Exposes Over 100 Vulnerabilities Found by AI Models, Sparking Open-Source Policy Debate
Researcher used Claude AI to find critical flaws in UK public sector code, raising questions about whether governments should stop publishing source code.
Security researcher Chris Nesbitt-Smith from ControlPlane used Anthropic's Claude Opus and Sonnet AI models to scan publicly available codebases across multiple UK government departments, discovering more than 100 serious vulnerabilities. These flaws put sensitive data at risk due to poor cyber hygiene rather than sophisticated hacking techniques. Nesbitt-Smith noted that he used consumer-grade models on a laptop and stated that many issues could have been caught by routine IT health checks.
The most severe case involved the Planning Inspectorate, which handles land-use matters across England. The agency failed to fully remove login credentials after accidentally committing them to a public GitHub repository. These credentials provided "god-tier" read and write access to Microsoft Entra ID, allowing access to all SharePoint sites, private OneDrive accounts, and HR records. Although the agency fixed the vulnerability within 20 minutes of being reported and verified no data breach occurred, the incident highlights neglect in maintaining technology estates.
The audit covered 349 public sector codebases across 33 organizations, with vulnerabilities found in approximately two-thirds of them. Affected entities included the Department for Education (involving school procurement services, teacher application systems, and training provider registers) and the Scottish Government's open data portal. While the UK government has defaulted to openly publishing code produced with public money for around a decade to enhance transparency and reuse, funding squeezes have led to neglected maintenance.
As AI accelerates vulnerability discovery, arguments for public sector departments to stop publishing source code have intensified. Reports indicate the NHS ordered technology teams to transition away from open source code in May amid security concerns. However, Nesbitt-Smith warned that closing repositories without fixing underlying issues is the "worst case scenario," as adversaries may have already mirrored these repositories, and closure might draw more attention to the problems.