Researcher using Claude finds 100+ serious flaws in UK government code, including 'god-tier' Microsoft access
ControlPlane's Chris Nesbitt-Smith told WIRED a Planning Inspectorate login left on GitHub would have given read and write access to all its SharePoint sites and staff OneDrive accounts; the agency says it fixed the flaw within 20 minutes and no breach occurred.
Why it matters
The case shows how cheaply AI models now help find security weaknesses: Nesbitt-Smith says he used consumer-grade Claude Opus and Sonnet on a laptop, and that many of the issues could have been caught by a routine IT health check. The UK government has published its code openly for about a decade, including at the health department, the Home Office and local councils, but WIRED reports funding squeezes have left maintenance neglected. OpenUK says the Planning Inspectorate leak was a housekeeping failure, not an open-source problem. Watch whether departments audit their public repositories.
Key facts
- More than 100 serious vulnerabilities found in public UK government code
- Found using Claude Opus and Sonnet models on a laptop
- Planning Inspectorate credentials left on GitHub gave Microsoft Entra ID access
- Access covered all SharePoint sites and staff OneDrive accounts
- Agency says it fixed the flaw within 20 minutes of the report
- Planning Inspectorate says no data breach occurred