Researcher Using Claude Finds Over 100 Serious Flaws in UK Government Open-Source Code

A security researcher armed with nothing more than a laptop and Anthropic's Claude models has found more than 100 serious flaws in code published by UK public bodies. Chris Nesbitt-Smith of the security firm ControlPlane scanned 349 codebases belonging to 33 organisations and found problems in around two thirds of them. The worst case involved leaked login credentials at the Planning Inspectorate that, he says, opened the door to the agency's entire Microsoft environment.

The findings were first reported by Wired, and they land at an awkward moment for the public sector. The UK government has published code built with public money by default for about a decade, in the name of transparency and so other bodies can reuse it. The research suggests that much of that code has been left to rot, and that AI tools now make it far cheaper for anyone to find the gaps.

What the researcher found

Nesbitt-Smith ran consumer-grade Claude Opus and Sonnet models on his own laptop, scanning public repositories that UK departments, agencies and councils have published on GitHub. He found more than 100 serious flaws across the 349 codebases he examined, with around two thirds of the projects carrying at least one vulnerability.

His point is that none of this needed exotic skill or expensive tooling. A routine IT health check could have caught many of the problems, he told Wired, and the flaws were mostly basic mistakes rather than clever exploits. "None of this is the level of sophistication that general media is worried about in terms of cyber attacks," he said. "It's all daft stuff."

The Planning Inspectorate leak

The most serious single finding concerned the Planning Inspectorate, the agency that handles land-use and planning decisions across England. Nesbitt-Smith found login credentials that had been accidentally committed to a public GitHub repository and then never properly removed. The credentials apparently did not expire.

According to his account, the access those credentials gave through Microsoft Entra ID would have allowed what he called "god-tier" read and write access to every SharePoint site in the agency, as well as to employees' private OneDrive accounts, including HR records. It would also have reached libraries holding evidence under legal hold for statutory planning inquiries and appeals. "The option for ransomwaring them, for encrypting all the data, or just stealing all the data, was abundantly there," he said.

The agency told Wired that its monitoring tools had already detected his activity in August, and that it was treating the matter as a cyber incident by the time ControlPlane got in touch. It said the vulnerability was fixed within 20 minutes of the report and confirmed that no data breach had occurred. "We have reviewed and strengthened our systems and processes to prevent this type of issue recurring," a spokesperson said.

Flaws at the Department for Education and in Scotland

The Planning Inspectorate was not the only body with serious problems. Nesbitt-Smith also reported several flaws in Department for Education code, affecting a procurement service used by schools, a teacher application service that holds personal details, qualifications, employment history and identity documents, and England's main register of government-funded training and apprenticeship providers.

In Scotland, an open data portal run by the Scottish Government let any visitor read administrative account information and change the site's configuration. All of the organisations involved have since fixed the issues, according to Wired, but the pattern across departments points to a wider problem than a single careless commit.

Why the code is public in the first place

The UK's open code policy dates back about a decade. Code built with public money is published by default, so that other public bodies can reuse it instead of paying to build the same thing twice, and so that the public can see how government systems work. The code in question spans the Department of Health and Social Care, the Home Office, local councils and many smaller bodies.

Supporters of the policy say the research proves it works. A researcher found the flaws precisely because the code was public, and the organisations fixed them once told. Amanda Brock, chief executive of the industry group OpenUK, said the incident came from poor internal housekeeping rather than open publishing itself. "That's not an open source security issue," she said.

The debate over hiding public code

Even so, some in the public sector have argued for taking source code out of public view now that AI tools make it cheaper to find flaws. Wired noted that the NHS reportedly told its technology teams in May to move away from open-source code over concerns about AI-driven attacks.

Nesbitt-Smith called that approach, without first fixing the underlying flaws, the "worst case scenario". Pulling code from public view would stop independent researchers from finding problems, he argued, while adversaries have probably already copied the repositories. The flaws would remain, but the people most likely to report them would be locked out.

What happens next

The immediate fallout is likely to be a round of internal reviews across the departments named, and probably several more that were not. The Planning Inspectorate says it has strengthened its systems, and the other organisations have patched the reported issues. The harder question is whether the government treats this as a one-off embarrassment or as a prompt to fund the unglamorous work of maintaining public code.

Frequently Asked Questions

What did the researcher find in UK government code?

Chris Nesbitt-Smith of ControlPlane used Anthropic's Claude models to scan 349 public codebases from 33 UK public bodies and found more than 100 serious flaws, with around two thirds of the projects affected. The worst case was a leaked credential at the Planning Inspectorate that gave access to the agency's entire Microsoft environment.

Was any data stolen from the Planning Inspectorate?

No data breach was confirmed. The agency said its monitoring tools detected the researcher's activity in August, that it fixed the vulnerability within 20 minutes of being told, and that it has reviewed and strengthened its systems to prevent a repeat.

Will the UK government stop publishing its code?

There is no sign of a general retreat. Some bodies, including reportedly the NHS, have moved away from publishing code over AI security concerns, but the researcher and OpenUK argue that hiding code would make things worse, because it would stop independent researchers finding flaws while attackers keep the copies they already have.