Security researcher discovers over 100 serious vulnerabilities in publicly released UK government code using AI tools
November 12, 2026 · 3 min read
A security researcher at ControlPlane identified more than 100 severe security flaws in code publicly released by the UK government on November 10. The vulnerabilities could expose sensitive data and create opportunities for data theft and ransomware attacks, according to reporting by Wired. The researcher, Chris Nesbitt-Smith, used Claude Opus and Sonnet AI models to scan the government's publicly available code repositories.
For approximately the past decade, the UK government has made code developed with public funds publicly available by default. This policy aimed to increase transparency in government operations and allow other institutions to reuse code and reduce development costs. Departments including the UK Department of Health and Social Care, the Home Office, and local government bodies have adopted this practice.
Nesbitt-Smith emphasized that he used only consumer-grade AI models running on a laptop, and many of the vulnerabilities could have been discovered through routine IT security checks. He characterized the problems as basic errors rather than sophisticated cyberattacks. The researcher scanned 349 public sector code repositories across 33 institutions and found that approximately two-thirds contained security vulnerabilities.
The most serious vulnerability involved the UK Planning Inspectorate, which handles land use planning matters across England. An employee accidentally submitted login credentials to the public code repository GitHub. The organization failed to fully revoke these credentials, leaving them functional. The Microsoft Entra ID credentials had extremely broad access permissions with no expiration date, granting read and write access to all SharePoint websites and employee private OneDrive accounts, including human resources records. Attackers could potentially access sensitive files containing statutory planning investigations and appeal evidence protected by legal preservation requirements.
Nesbitt-Smith stated that attackers could use these permissions to deploy ransomware, encrypt all data, or steal all data. The Planning Inspectorate said its cybersecurity monitoring tools detected Nesbitt-Smith's activity in August. The organization confirmed and fixed the vulnerability within 20 minutes of receiving the report and verified that no data breach occurred. The agency said it reviewed and strengthened related systems and processes to prevent similar issues.
Multiple projects within the UK Department for Education were found to contain vulnerabilities, including procurement services for schools, a teacher application service, and the main registration system for government-funded training institutions and apprenticeship programs. The teacher application service contains sensitive information including personal details, educational qualifications, work history, and identity documents. Nesbitt-Smith also discovered vulnerabilities in a Scottish government open data portal that could allow visitors to read administrator account information and modify website configuration.
The discovery has sparked debate about whether the UK public sector should continue publicly releasing source code. In May, the UK National Health Service reportedly asked technical teams to gradually stop using open source code due to concerns about security risks posed by AI models. However, Nesbitt-Smith argued that if the government simply stops releasing code without immediately fixing existing vulnerabilities, it could produce the worst outcome. He noted that public code allows security researchers to discover and report problems, while potential attackers have likely already copied and retained these repositories and can continue researching and exploiting vulnerabilities within them.