Market & Regulation
UK Gov Open Source Code Exposed by AI Security Audit
WIRED AIhigh confidence
Why it matters
- →AI tools can now easily automate the discovery of basic security misconfigurations in public codebases.
- →Open-source transparency does not guarantee security if internal maintenance and hygiene are neglected.
- →Public sector organizations may face pressure to restrict code access, potentially reducing external auditability.
Security researcher Chris Nesbitt-Smith identified more than 100 vulnerabilities across UK government codebases using consumer-grade AI models, including Claude’s Opus and Sonnet. The most severe issue involved the Planning Inspectorate accidentally publishing Microsoft Entra ID credentials with full read/write access to SharePoint and OneDrive accounts containing HR records. Although the agency detected and fixed the breach within 20 minutes of notification, similar lapses were found in the Department of Education and Scottish Government portals. The findings have reignited debate over whether public sector entities should abandon open-source publishing given AI-accelerated vulnerability discovery.
Read originalThe story around this
Earlier coverage that leads up to this article, and what followed. Lines connect each piece to the closest one after it, converging here.
