Researcher Finds 100+ Flaws in Public UK Gov Code, Including 'God-Tier' Access

Chris Nesbitt-Smith, a researcher at security firm ControlPlane, uncovered more than 100 serious vulnerabilities across publicly published UK government code, WIRED reports. He found the issues using Anthropic's Claude Opus and Sonnet models on a consumer laptop, and says most were the kind of thing a routine IT health check would catch. "None of this is the level of sophistication that general media is worried about in terms of cyber attacks," he told WIRED. "It's all daft stuff."

The most dangerous find sat with the Planning Inspectorate, which handles land-use matters across England. The agency had accidentally committed login credentials to a public GitHub repository and never fully removed them, according to Nesbitt-Smith. Those credentials unlocked the complete Microsoft Entra ID, which he said would have handed over "god-tier" read and write access to every SharePoint site and private employee OneDrive account, including HR records, plus sensitive libraries holding evidence under legal hold for statutory planning inquiries and appeals. "The option for ransomwaring them, for encrypting all the data, or just stealing all the data, was abundantly there," he said.

A Planning Inspectorate spokesperson told WIRED its monitoring tools flagged Nesbitt-Smith's activity in August and it was already treating the matter as a cyber incident when ControlPlane reached out. The agency says it identified and fixed the vulnerability within 20 minutes of the report and confirmed no data breach occurred. "We have reviewed and strengthened our systems and processes to prevent this type of issue recurring," the spokesperson said.

Amanda Brock, chief executive of industry group OpenUK, pushed back on framing the lapse as an open source problem. The Planning Inspectorate issue "isn't about open source but internal housekeeping when using public tools," she told WIRED, adding that the data was exposed "because of a failure not to follow good process."

Nesbitt-Smith scanned 349 public sector codebases across 33 organizations and said he found vulnerabilities in about two-thirds of them. The Department of Education's code carried several, including in a procurement service used by schools, a teacher application service holding personal details, qualifications, employment history and identity documents, and England's main register of government-funded training providers and apprenticeships. A Scottish Government open data portal flaw would have let any visitor read administrative account information and alter site configuration. The organizations have since dealt with the issues.

With AI speeding up vulnerability discovery, some have argued public sector departments should stop publishing source code altogether. The NHS reportedly told technology teams in May to move away from open source over security concerns tied to AI models. Nesbitt-Smith warned that closing repositories without fixing the underlying flaws is the "worst case scenario," since adversaries have likely already mirrored them. "Unless you're going to go and fix all of the problems, if anything, you're probably drawing more attention to it by closing it," he said.