Researcher with a laptop and Claude finds 100+ holes in UK government code

When people talk about AI and cybersecurity, they usually paint a frightening picture: superintelligent models breaking into everything in sight. The reality in Wired's recent story is far more mundane, and more uncomfortable. A researcher took an ordinary laptop, connected Claude Opus and Sonnet, and in a short time found more than a hundred serious vulnerabilities in the British government's open-source code.

What exactly was found

For about ten years the UK has followed a principle that code written with public money is published openly. It is transparent, and reuse saves budget. Chris Nesbitt-Smith of ControlPlane scanned 349 public repositories belonging to 33 organizations, including the Department of Health and Social Care, the Home Office and local authorities. Vulnerabilities turned up in roughly two-thirds of the codebases.

The most serious case involved the Planning Inspectorate, the agency that handles land-use matters in England. Staff accidentally committed Microsoft Entra ID credentials to public GitHub and did not fully revoke them. According to the researcher, those credentials gave "god-level" read and write access to all SharePoint sites and employees' personal OneDrive accounts, including HR records and libraries of evidence in planning disputes. By all appearances, they never expired.

At the Department for Education, holes were found in the school procurement service, in an app for teachers (containing personal data, qualifications and document scans), and in the main register of accredited training providers. On the Scottish government's open data portal, any visitor could read administrator account data and change the site's configuration. Everything has now been fixed.

This isn't about "super-sophisticated attacks"

The most important thing about the story is how banal the findings are. Nesbitt-Smith says none of it requires the sophistication the press writes about: "It's all stupid stuff." A routine IT audit would have caught much of it. AI isn't inventing new exploits here; it makes cheap and fast what used to require an expensive specialist and time. Anyone with a subscription and a laptop can now scan hundreds of repositories. Which means an attacker can, too.

A Planning Inspectorate spokesperson told Wired that its monitoring systems noticed the researcher's activity right away in August, and that the vulnerability was closed within 20 minutes of being reported. There was no data breach, they said. Amanda Brock, head of the industry group OpenUK, stresses that the problem is not open code but broken process hygiene. Secrets should never end up in a repository in the first place.

Closing the code is not a solution

After the wave of findings, calls have emerged in the public sector to stop publishing source code. According to reports, the NHS in May told technology teams to move away from open source over concerns about AI models. Nesbitt-Smith calls closing code without fixing the holes the "worst-case scenario." Researchers will stop finding problems, while attackers have most likely already cloned the repositories and will retain access to old versions. He compares it to a sign reading "Here be dragons, but don't look."

What to do in practice

The lesson for teams is simple and boring, but urgent:

• Enable secret scanning and push protection in GitHub so keys don't end up in commits.
• If a key leaks, revoke it completely rather than just deleting the file: commit history keeps everything.
• Give tokens minimal permissions and reasonable lifetimes. It was the lack of limits that turned a mistake into a potential catastrophe.
• Run your own repositories through the same process the researcher used before someone else does.

The story has a limitation too: the publication gives no details on the share of false positives or how much manual verification was required. But that does not undo the main conclusion: AI has cut the price of an audit to almost zero, and "security through obscurity" has finally stopped being a strategy.