Researcher Using Claude Finds Over 100 Serious Flaws in UK Government Open-Source Code

Chris Nesbitt-Smith of the security firm ControlPlane found more than 100 serious flaws using Anthropic's Claude Opus and Sonnet models, according to Wired, which first reported the findings. He said he ran consumer-grade models on a laptop, and that a routine IT health check could have caught many of the problems. "None of this is the level of sophistication that general media is worried about in terms of cyber attacks," he told the magazine. "It's all daft stuff."

The findings come as public bodies debate whether to keep publishing their code now that AI tools make it cheaper to find flaws. The UK government has published code built with public money by default for about a decade, including at the Department of Health and Social Care, the Home Office and local councils. The policy aims at transparency and lets other bodies reuse the code. But Wired reported that funding squeezes have left departments neglecting maintenance of their technology.

The Planning Inspectorate handles land-use matters across England. It had accidentally committed login credentials to a public GitHub repository and then failed to remove them fully, Nesbitt-Smith said. The credentials apparently did not expire. He said the Microsoft Entra ID access they gave would have allowed "god-tier" read and write access to every SharePoint site and to employees' private OneDrive accounts, including HR records. It would also have reached libraries that hold evidence under legal hold for statutory planning inquiries and appeals. "The option for ransomwaring them, for encrypting all the data, or just stealing all the data, was abundantly there," he said.

A Planning Inspectorate spokesperson told Wired that its monitoring tools detected Nesbitt-Smith's activity in August. The agency was already treating it as a cyber incident when ControlPlane got in touch. It said it fixed the vulnerability within 20 minutes of the report and confirmed that no data breach had occurred. "We have reviewed and strengthened our systems and processes to prevent this type of issue recurring," the spokesperson said.

Amanda Brock, chief executive of the industry group OpenUK, said the incident came from poor internal housekeeping rather than open publishing itself. "That's not an open source security issue," she said.

Nesbitt-Smith also reported several flaws in Department for Education code. They affected a procurement service used by schools, a teacher application service that holds personal details, qualifications, employment history and identity documents, and England's main register of government-funded training and apprenticeship providers. A Scottish Government open data portal let any visitor read administrative account information and change the site's configuration. All the organisations have since fixed the issues, according to Wired.

Some in the public sector have argued for taking source code out of public view. Wired noted that the NHS reportedly told its technology teams in May to move away from open-source code over concerns about AI-driven attacks. Nesbitt-Smith called that approach, without first fixing the underlying flaws, the "worst case scenario". It would stop researchers from finding problems, he said, and adversaries have probably already copied the repositories.