Researcher Finds 100+ UK Government Code Flaws, Including 'God-Tier' Access to Planning Data
Updated
Updated · WIRED · Nov 10
Researcher Finds 100+ UK Government Code Flaws, Including 'God-Tier' Access to Planning Data
1 articles · Updated · WIRED · Nov 10
Summary
More than 100 serious vulnerabilities were found across publicly available UK government codebases, with issues in about two-thirds of 349 repositories spanning 33 public-sector organizations.
One Planning Inspectorate flaw exposed Microsoft Entra ID credentials that could have enabled read-write access to all SharePoint sites, private employee OneDrive accounts and legally sensitive evidence libraries.
The agency said its monitoring tools detected the researcher’s activity in August, fixed the exposed credentials within 20 minutes of the report and found no evidence of a data breach.
Chris Nesbitt-Smith said he uncovered many of the flaws with consumer-grade Claude models on a laptop, arguing routine IT health checks should have caught them and blaming poor maintenance rather than sophisticated attacks.
The findings land amid debate over whether UK public bodies should stop publishing source code as AI speeds vulnerability discovery, though the researcher warned closing repositories without fixing flaws could make risks harder to detect.