UK agencies face 100-plus public-code security flaws

ControlPlane security researcher Chris Nesbitt-Smith found more than 100 serious vulnerabilities in publicly available UK government code, WIRED reported on Nov. 10.

The review covered 349 public-sector codebases across 33 organizations, and Nesbitt-Smith said vulnerabilities appeared in around two-thirds of them, including systems linked to health, education, planning and local authorities.

Nesbitt-Smith used Anthropic’s Claude Opus and Sonnet AI models to examine public repositories, but told WIRED the work did not require advanced tooling. “None of this is the level of sophistication that general media is worried about in terms of cyber attacks,” he said. “It’s all daft stuff.”

The most serious case involved the Planning Inspectorate, which handles land-use matters in England. Nesbitt-Smith said a Microsoft Entra ID login, accidentally committed to GitHub and not fully removed, would have allowed broad read-and-write access to SharePoint sites and private employee OneDrive accounts.

“The option for ransomwaring them, for encrypting all the data, or just stealing all the data, was abundantly there,” Nesbitt-Smith told WIRED. The researcher said the access could have included HR records and evidence libraries used for statutory planning inquiries and appeals.

A Planning Inspectorate spokesperson told WIRED its monitoring tools detected Nesbitt-Smith’s activity in August and that the agency was already treating the matter as a cyber incident when ControlPlane made contact. The spokesperson said the vulnerability was fixed within 20 minutes of the report and that no data breach occurred.

The findings cut across a long-running UK policy preference for publishing code built with public money. The government has used open publication for about a decade to support transparency and reuse, including at the Department of Health and Social Care, the Home Office and local authorities.

The issue is not simply whether code is public. Amanda Brock, chief executive officer of OpenUK, told WIRED the Planning Inspectorate case reflected process failure rather than an inherent open-source flaw. “That data was exposed because of a failure not to follow good process,” she said.

“That’s not an open source security issue.”

Nesbitt-Smith also reported vulnerabilities in Department for Education code, including a schools procurement service, a teacher application service containing personal details and identity documents, and England’s main register of government-funded training providers and apprenticeships. WIRED reported that the affected organizations have since dealt with the issues.

The debate has widened as AI tools lower the effort needed to search public code for weak credentials and misconfigurations. WIRED cited recent arguments for public bodies to stop publishing source code openly, and reported that the NHS ordered technology teams in May to move away from open source code because of AI-related security concerns.

Nesbitt-Smith warned that closing repositories without fixing the flaws could make matters worse, because adversaries may already have copied them. “Unless you’re going to go and fix all of the problems, if anything, you’re probably drawing more attention to it by closing it,” he told WIRED.

Source: trade-press report, WIRED, Nov. 10, 2026