A researcher used Claude on a laptop to find 100+ serious flaws in UK government code, including a "god-tier" login
About two-thirds of 349 public codebases had vulnerabilities. The worst was an unexpired credential the Planning Inspectorate had committed to GitHub.
DevIsDead Newsroom
A security researcher scanned the UK government's public code with off-the-shelf AI models and turned up more than 100 serious vulnerabilities, Isabella Ward reports for WIRED.
Chris Nesbitt-Smith of ControlPlane used Anthropic's Opus and Sonnet models on a laptop. He's blunt that this was not advanced hacking: many of the problems would have shown up in a routine IT health check, and he calls them "daft stuff."
The scale
The UK has published code it builds with public money by default for about a decade, for transparency and reuse. But tight budgets have left departments skimping on upkeep. Nesbitt-Smith scanned 349 public sector codebases from 33 organizations and found vulnerabilities in around two-thirds.
The worst one
The Planning Inspectorate, which handles land-use cases in England, had accidentally committed a login to GitHub and never fully removed it. The credentials apparently didn't expire and opened a full Microsoft Entra ID with read and write access to every SharePoint site and staff OneDrive, including HR records and evidence held for legal planning inquiries. Nesbitt-Smith says someone could easily have encrypted it all for ransom or stolen it.
The agency says its monitoring flagged his activity in August, it was already treating it as an incident, it fixed the hole within 20 minutes of the report, and no data was breached.
Other finds included issues in Department for Education services for school procurement, teacher applications and the register of government-funded training providers, plus a Scottish Government open data portal that let any visitor read admin account details and change settings. All have been addressed.
Don't just close the repos
Some argue that with AI speeding up bug hunting, governments should stop publishing code; the NHS reportedly told teams in May to move away from open source. Nesbitt-Smith says hiding code without fixing it is the worst option: adversaries have likely mirrored the repos already, and closing them only signals where to look. OpenUK's Amanda Brock adds that the leaked login was a housekeeping failure, not an open source problem.
Scoreboard update: Draw. AI finds the bugs fast, but humans left them there and had to fix them.
Stay undead.
Comments 0