# UK Government Websites Exposed to High-Risk Flaws Found via Consumer AI Scans

> Security tests using off-the-shelf artificial intelligence tools revealed widespread vulnerabilities in UK government repositories, including administrative credentials that left internal networks exposed.

**Type:** article · **Category:** AI · **Published:** 2026-11-10 · **Source:** TrendKia
**Canonical:** https://trendkia.com/en/ai/uk-ki-sarakari-vebasaiton-men-gnbhira-suraksha-khamiyan-ujagara-sadharana-ai-modala-ki-jancha-men-khulasa-58659 · **Language:** English
**Tags:** UK Government, Cybersecurity, Artificial Intelligence, Data Breach, GitHub, Open Source

A security research effort using standard artificial intelligence models has uncovered widespread cyber vulnerabilities across dozens of United Kingdom public sector organizations. For nearly a decade, UK government bodies—including the Department of Health and Social Care, the Home Office, and various local councils—have published code publicly to maintain transparency and reduce costs. However, years of tight budgets have led to neglected infrastructure maintenance, leaving publicly accessible code repositories vulnerable to basic security oversights.

## Administrative Credentials Left Exposed in Public Repositories
ControlPlane security researcher Chris Nesbitt-Smith evaluated 349 public sector codebases across 33 organizations using consumer-grade Claude Opus and Sonnet models on a standard laptop. Roughly two-thirds of the scanned repositories contained security flaws. He emphasized that these issues did not require advanced nation-state cyberattack capabilities, but were basic mistakes that standard routine IT health checks should have caught.

The most severe vulnerability occurred at the Planning Inspectorate, the agency responsible for land-use matters across England. The agency accidentally committed administrative credentials to a public GitHub repository and failed to revoke them properly. Because the credentials remained active and offered wide-ranging administrative privileges, the system was left exposed. This exposure provided access to a complete Microsoft Entra ID system, granting broad read and write authorization to all internal SharePoint sites, personal employee OneDrive accounts containing HR files, and confidential legal evidence libraries for statutory planning appeals. The situation created clear risks of data theft or ransomware encryption.

## Institutional Responses and Specific Vulnerabilities
A spokesperson for the Planning Inspectorate stated that its cyber monitoring tools detected the activity in August and that the agency was already addressing the issue when ControlPlane reached out. The vulnerability was patched within 20 minutes of the report, and verification checks confirmed that no data breach occurred. Amanda Brock, chief executive officer of non-profit group OpenUK, noted that the exposure resulted from internal process management failures when using public digital platforms rather than inherent flaws in open-source software.

Other affected entities included the Department for Education, where vulnerabilities were identified in school procurement services, a teacher application system containing personal details, qualifications, employment histories, and identity documents, as well as the national registry for government-funded training providers and apprenticeships. Separately, a vulnerability in the Scottish Government open data portal allowed visitors to read administrative account details and modify site configurations. All affected organizations have since resolved these vulnerabilities.

## The Debate Over Open-Source Code Transparency
The rapid advancement of AI tools accelerating vulnerability detection has sparked debate over whether public sector bodies should stop sharing source code openly. In May, the National Health Service ordered tech teams to move away from open-source code over security risks related to AI capabilities.

However, security experts warn that hiding source code without addressing underlying flaws creates a false sense of security. Closing repositories prevents independent researchers from discovering bugs while adversaries may already possess mirrored copies of the public code, drawing unwanted attention to unpatched infrastructure.

## What this means for you
Vulnerabilities in public sector repositories highlight how minor oversights in government IT maintenance can lead to significant data exposure risks.

- **For Citizens and Staff:** Sensitive personal information, including identity records and qualifications stored in government portals, faced exposure risks.
- **Administrative Security:** Unprotected administrative credentials created systemic vulnerabilities, opening vital legal and internal HR databases to ransomware threats.
- **Policy Reassessments:** Public institutions are forced to balance open-source transparency policies against stricter access controls.
- **Global Tech Lessons:** Digital agencies worldwide must combine open-code initiatives with mandatory, continuous security checks to prevent routine breaches.

## Why this happened
The vulnerabilities stemmed from chronic funding squeezes combined with inadequate routine maintenance across public software repositories.

- **Maintenance Neglect:** Tight budgets led public sector departments to delay necessary security updates and code checks.
- **Process Failures:** Developers accidentally committed active credentials to public GitHub repositories without revoking access promptly.
- **AI-Accelerated Discovery:** Readily available consumer AI tools have made it significantly easier to scan and spot basic security flaws quickly.

## Questions & Answers

### 1. Who discovered the security flaws in UK government websites?
Security researcher Chris Nesbitt-Smith of ControlPlane discovered the vulnerabilities using consumer-grade AI models on a laptop.

### 2. Was any government data stolen during these incidents?
The Planning Inspectorate verified that their cyber monitoring systems handled the issue and confirmed no data breach took place.

### 3. Which major public departments were affected by these flaws?
Affected entities included the Planning Inspectorate, the Department for Education, and the Scottish Government's open data portal.

### 4. Is the UK government stopping the use of open-source code?
While some agencies like the NHS have considered transitioning away from open source, experts argue that fixing underlying security checks is more effective than closing code.

---
_TrendKia — Har trend, sabse pehle.. Machine-readable view; canonical HTML at the URL above._