AI Audit Finds Serious Flaws in UK Government Code

A security researcher’s audit of publicly available UK government code has uncovered more than 100 serious vulnerabilities across public-sector projects, according to a report published on 10 November. The findings raise an uncomfortable question for government technology teams: when AI makes it quicker to inspect code, can routine security checks keep up? The issues described by the researcher were disclosed to the affected organisations and addressed. The most serious case was a dangerous credential exposure, not a confirmed data theft.

ControlPlane researcher Chris Nesbitt-Smith examined 349 public-sector codebases across 33 organisations using consumer versions of Anthropic’s Claude models, WIRED reports. He said vulnerabilities appeared in about two-thirds of those codebases. The AI tools helped identify leads, but the underlying weaknesses included familiar errors such as overpowered credentials and missing access checks. The figures describe the researcher’s survey, not a government-wide census of every UK service.

In the most consequential finding, a Microsoft Entra ID application credential for the Planning Inspectorate was committed to a public GitHub repository. Although the file had been removed from the visible branch, ControlPlane says the old commit remained retrievable for 18 months. The credential was still valid and had broad permissions to read and write across SharePoint sites and employees’ private OneDrive accounts. It could also have reached libraries holding evidence for statutory planning inquiries.

That description is about potential access. ControlPlane says it verified permissions through limited, non-destructive tests rather than collecting live files. The Planning Inspectorate told WIRED that monitoring detected the researcher’s activity, that it revoked the credential within about 20 minutes of receiving the report, and that it found no data breach. Removing a secret from the latest version of a repository does not revoke the credential itself, a distinction that makes this case useful far beyond government.

Other findings affected Department for Education services. In one school procurement support form, ControlPlane found that someone who obtained a request identifier could alter that request without signing in. The department fixed the access-control gap in July. In a Scottish Government open-data portal, a long-lived administrator token was embedded in JavaScript delivered to visitors. The service was decommissioned in June after disclosure. These timelines matter: the individual vulnerabilities were not discovered this morning.

The headline lesson is not that Claude invented a new way to attack government systems. It helped a researcher search a large amount of public code more efficiently. An attacker could use similar tools, but so can defenders. The sensible response is to scan repositories for secrets, keep permissions narrow, verify ownership checks and revoke exposed credentials at the identity provider. Shutting public code repositories without fixing the underlying problems would not remove copies that may already exist.

Open code can help citizens and researchers understand public systems, but transparency does not replace maintenance. A public project needs the same credential hygiene, testing and vulnerability-disclosure process as a private one. TechBooky has also covered the UK’s warning about AI-assisted cyber risks to critical infrastructure. This audit offers a more immediate, less speculative picture of how small security mistakes can create large potential exposure.

The Planning Inspectorate’s response shows that quick detection and revocation can limit harm. The harder challenge is preventing similarly broad, long-lived credentials from reaching code in the first place. AI can shorten the time it takes to find such mistakes. Government security processes have to shorten it too.