UK Government: 100 Vulnerabilities in Open-Source Code

A British security researcher found more than 100 serious vulnerabilities in publicly available UK government code, including credentials that would have given read and write access to all SharePoint sites and private employee OneDrive accounts — what he called "god-tier access." The discovery has reignited debate about open-source code publication in the public sector and the role of artificial intelligence in automated vulnerability analysis.

Chris Nesbitt-Smith, a researcher at ControlPlane, analyzed 349 code repositories published by 33 UK public sector organizations, including the Department of Health and Social Care, the Home Office, and local authorities. Using consumer-grade versions of Claude Opus and Sonnet models running on an ordinary laptop, he found vulnerabilities in two-thirds of the scanned repositories.

The most serious case

The most serious issue involved the Planning Inspectorate, the agency responsible for land-use matters across England. The agency had accidentally published Microsoft Entra ID credentials in a public GitHub repository. According to Nesbitt-Smith, the credentials were never fully removed and, combined with the fact that they apparently did not expire, provided full read and write access to all SharePoint sites and private employee OneDrive accounts, including HR records and sensitive materials held under legal hold for planning inquiries and administrative appeals.

"The option for ransomwaring them, for encrypting all the data, or just stealing all the data, was abundantly there," Nesbitt-Smith told WIRED. "None of this is at the level of sophistication that general media is worried about in terms of cyber attacks. It's all daft stuff."

The Planning Inspectorate told WIRED that its monitoring tools detected Nesbitt-Smith's activity in August and were already handling it as a cyber incident. The vulnerability was fixed within 20 minutes of the report, and the agency verified that no data breach had occurred.

What else was exposed

Beyond the Planning Inspectorate case, the researcher found flaws in Department of Education services, including a procurement system used by schools, a teacher application service containing personal information, qualifications, employment history, and identity documents, and England's main register of government-funded training providers and apprenticeships. A Scottish Government open data portal allowed any visitor to read administrative account information and change site configuration.

Most of the problems could have been caught by a routine IT health check, according to the researcher himself. What has changed is the ability of AI to systematically scan large volumes of code, identifying error patterns that would have gone unnoticed in manual audits.

The debate over open-source code in the public sector

The case reignites a discussion that has been gaining momentum in recent months: the UK government has publicly published code it produces with public money for about a decade, in the name of transparency and cost efficiency. But now, with AI accelerating vulnerability discovery, some argue that public sector bodies should stop publishing source code.

The NHS (UK National Health Service) reportedly ordered technology teams to move to proprietary solutions in May, due to security concerns related to the impact of AI models. But Nesbitt-Smith considers that closing repositories without fixing underlying problems would be the "worst-case scenario": it would prevent friendly researchers from finding vulnerabilities, while adversaries may already have mirrored the repositories and retained access.

"Unless you're going to go and fix all of the problems, if anything, you're probably drawing more attention to it by closing it," he argued. "It's like saying 'here be dragons. Don't look here, please.'"

Amanda Brock, CEO of the nonprofit organization OpenUK, said the Planning Inspectorate case "isn't about open source but about internal housekeeping when using public tools." "The data was exposed because there was a failure to follow good process. That's not an open source security issue."

The role of AI in security

The case illustrates a growing trend: accessible AI models are democratizing vulnerability analysis. Anyone with a laptop and access to consumer-grade models can scan public repositories and find errors that previously would have required dedicated audit teams. For better and for worse.

The question is whether the UK government — and governments in other countries — will be prepared to respond as quickly as the tools that reveal the errors.

Sources: WIRED, ATLABYTE, AI Parabellum

✓ Independent sources cross-checked and verified before publishing