A security research effort using standard artificial intelligence models has uncovered widespread cyber vulnerabilities across dozens of United Kingdom public sector organizations. For nearly a decade, UK government bodies—including the Department of Health and Social Care, the Home Office, and various local councils—have published code publicly to maintain transparency and reduce costs. However, years of tight budgets have led to neglected infrastructure maintenance, leaving publicly accessible code repositories vulnerable to basic security oversights.
Administrative Credentials Left Exposed in Public Repositories
ControlPlane security researcher Chris Nesbitt-Smith evaluated 349 public sector codebases across 33 organizations using consumer-grade Claude Opus and Sonnet models on a standard laptop. Roughly two-thirds of the scanned repositories contained security flaws. He emphasized that these issues did not require advanced nation-state cyberattack capabilities, but were basic mistakes that standard routine IT health checks should have caught.
The most severe vulnerability occurred at the Planning Inspectorate, the agency responsible for land-use matters across England. The agency accidentally committed administrative credentials to a public GitHub repository and failed to revoke them properly. Because the credentials remained active and offered wide-ranging administrative privileges, the system was left exposed. This exposure provided access to a complete Microsoft Entra ID system, granting broad read and write authorization to all internal SharePoint sites, personal employee OneDrive accounts containing HR files, and confidential legal evidence libraries for statutory planning appeals. The situation created clear risks of data theft or ransomware encryption.
Institutional Responses and Specific Vulnerabilities
A spokesperson for the Planning Inspectorate stated that its cyber monitoring tools detected the activity in August and that the agency was already addressing the issue when ControlPlane reached out. The vulnerability was patched within 20 minutes of the report, and verification checks confirmed that no data breach occurred. Amanda Brock, chief executive officer of non-profit group OpenUK, noted that the exposure resulted from internal process management failures when using public digital platforms rather than inherent flaws in open-source software.
Other affected entities included the Department for Education, where vulnerabilities were identified in school procurement services, a teacher application system containing personal details, qualifications, employment histories, and identity documents, as well as the national registry for government-funded training providers and apprenticeships. Separately, a vulnerability in the Scottish Government open data portal allowed visitors to read administrative account details and modify site configurations. All affected organizations have since resolved these vulnerabilities.
The Debate Over Open-Source Code Transparency
The rapid advancement of AI tools accelerating vulnerability detection has sparked debate over whether public sector bodies should stop sharing source code openly. In May, the National Health Service ordered tech teams to move away from open-source code over security risks related to AI capabilities.
However, security experts warn that hiding source code without addressing underlying flaws creates a false sense of security. Closing repositories prevents independent researchers from discovering bugs while adversaries may already possess mirrored copies of the public code, drawing unwanted attention to unpatched infrastructure.
