Skip to content
Serious Security Flaws Found in UK Government Code Expose Sensitive Data

Serious Security Flaws Found in UK Government Code Expose Sensitive Data

First seen 10 Nov 2026, 09:41 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •November 10, 2026 at 09:42 UTC

A security researcher identified over 100 vulnerabilities in UK government code, with two-thirds of the 349 scanned repositories affected. Notably, a Planning Inspectorate credential was accidentally committed to a public GitHub repository, allowing potential read-write access to sensitive SharePoint sites and employee OneDrive accounts. The researcher, Chris Nesbitt-Smith, utilized consumer-grade AI models to discover these flaws, which he stated could have been detected by routine IT health checks. The Planning Inspectorate responded promptly, fixing the issue within 20 minutes of being alerted and confirming no data breach occurred. The findings raise questions about the security of publicly available government code, especially as funding cuts have led to neglect in maintaining technology. The UK government has been criticized for its approach to open-source code amid concerns about AI tools making such practices riskier.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 6h ago How this analysis works

Timeline

2026-08-01
Researcher detected vulnerabilities
Chris Nesbitt-Smith found over 100 vulnerabilities in UK government code repositories using AI models.
Wired
2026-11-10
Public disclosure of findings
Wired published details of the vulnerabilities found in UK government code, highlighting the Planning Inspectorate case.
Wired
2026-11-10
Planning Inspectorate fixes exposure
The Planning Inspectorate addressed the credential exposure issue within 20 minutes of being notified by the researcher.
Wired

More articles in this cluster (2)

Following this threat?

Track Department Of Education in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (15)

1 / 3

Common questions

What specific vulnerabilities were found?
The vulnerabilities include exposed credentials, weak access controls, and insecure default settings across various government codebases.
How did the Planning Inspectorate respond?
The Planning Inspectorate detected the issue quickly and fixed the exposed credential within 20 minutes, confirming no data breach occurred.
What are the implications for UK government code practices?
The findings highlight the need for improved security measures and maintenance of publicly available government code, especially in light of funding cuts.