Researcher finds over 100 security flaws in UK government code

In short: A security researcher says he found more than 100 serious security weaknesses in UK government code posted online.

What happened

A security researcher at ControlPlane, Chris Nesbitt-Smith, told Wired he found more than 100 serious vulnerabilities in code published by UK public sector bodies. A vulnerability is a mistake that can let the wrong person get in, like a door that does not fully latch.

The UK government has often published code it builds with public money on sites like GitHub, a common place to store and share programming files. The idea is transparency and reuse. Nesbitt-Smith scanned 349 code collections across 33 organizations and said he found issues in around two-thirds of them.

One of the most serious cases involved the Planning Inspectorate in England. Nesbitt-Smith said a login credential, meaning a digital key, was accidentally posted online and not fully removed. He said it could have provided very broad access to Microsoft Entra ID, which manages logins for Microsoft services, and could have allowed access to SharePoint sites and private employee OneDrive accounts, including HR records.

The Planning Inspectorate told Wired its monitoring tools detected the activity in August and it fixed the issue within 20 minutes of being reported. It said it verified that no data breach occurred and that it strengthened its processes.

Nesbitt-Smith said he used Anthropic’s Claude Opus and Sonnet AI models, but he also said the problems were basic and could have been caught with routine checks.

Why it matters

This story is less about “AI hacking” and more about everyday maintenance. If government systems have simple mistakes, personal data and important records can be put at risk, even if nobody has stolen anything yet.

Source: Wired