UK Government Code Flaws Expose Sensitive Data
A security researcher identified more than 100 serious vulnerabilities across 349 public-sector codebases from 33 UK organisations, highlighting the risks of openly publishing government-funded software.
The most critical issue was discovered in the Planning Inspectorate, which inadvertently left a full Microsoft Entra ID login in a public GitHub repository. The credential granted unrestricted read-write access to all SharePoint sites, private employee OneDrive accounts, HR records, and evidence libraries under legal hold, creating a “god-tier” exposure that could have enabled ransomware, data theft, or encryption of the agency’s data.
ControlPlane researcher Chris Nesbitt-Smith used consumer-grade AI models (Claude Opus and Sonnet) on a laptop to locate the flaws, noting that many could have been caught by a routine IT health check. He described the vulnerabilities as “daft stuff” rather than sophisticated attacks.
The Planning Inspectorate’s cyber-monitoring tools detected the researcher’s activity in August. After being contacted, the agency patched the vulnerability within 20 minutes and confirmed no data breach occurred, subsequently strengthening its systems and processes.
Other findings included weaknesses in the Department of Education’s procurement service for schools, a teacher application platform storing personal and identity documents, and England’s register of government-funded training providers. A Scottish Government open-data portal also contained a flaw that would have let any visitor read administrative account details and alter site configuration.
The revelations have reignited debate over the UK’s long-standing practice of publishing code openly. The NHS reportedly ordered a shift away from open-source code in May due to AI-accelerated vulnerability discovery. Nesbitt-Smith warned that closing repositories without fixing underlying issues could draw more attention to them, as adversaries may already have mirrored the code.
OpenUK CEO Amanda Brock emphasized that the Planning Inspectorate incident stemmed from poor internal housekeeping rather than an inherent open-source security problem, underscoring the need for disciplined processes when using public tools.
Why it matters
These flaws show how AI can quickly surface critical government security gaps, urging public-sector IT teams to tighten code-management practices.
FAQ
How many vulnerabilities were found in the UK public-sector codebases?
More than 100 serious vulnerabilities were identified across 349 codebases.
What was the most severe vulnerability discovered?
A full Microsoft Entra ID login left in a public GitHub repository for the Planning Inspectorate, granting unrestricted access to SharePoint, OneDrive, HR records, and evidence libraries.
How quickly did the Planning Inspectorate respond?
The agency fixed the vulnerability within 20 minutes of being reported and confirmed no data breach occurred.
What concerns does this raise about open-source publishing in the public sector?
The findings suggest that AI can accelerate vulnerability discovery, prompting calls for tighter controls or reduced open-source publishing without comprehensive remediation.
Source: WIRED AI. See the original source for full details.
Scan with your phone
Scan with your phone