Security Flaws Across UK Government Sites Exposed ‘God-Tier’ Information
A security researcher uncovered over 100 serious vulnerabilities in UK government codebases, including "god-tier" access credentials, due to poor cyber hygiene and neglected maintenance.
Intelligence analysis by Gemini 2.5 Flash
Using consumer-grade AI models, a security researcher identified widespread, easily detectable security flaws across numerous UK government websites and code repositories. These vulnerabilities, stemming from inadequate maintenance and process failures rather than sophisticated attacks, exposed highly sensitive data, highlighting significant cyber hygiene issues within public sector IT.
Imagine the UK government has a big house with lots of important papers. A smart kid with a special magnifying glass (like a simple AI computer program) looked closely at the house's blueprints, which were left outside. He found over a hundred unlocked windows and doors, and even a hidden key that could open *everything*! The government quickly fixed the locks once he told them, but it showed they need to be more careful with their house plans.
Analysis
Chris Nesbitt-Smith's Discovery
Security researcher Chris Nesbitt-Smith utilized readily available AI models, specifically Claude's Opus and Sonnet, to uncover a significant number of vulnerabilities within publicly accessible UK government code. His investigation revealed over 100 serious flaws across 33 organizations, encompassing approximately two-thirds of the 349 public sector codebases he scanned. Nesbitt-Smith emphasized that these issues were not the result of sophisticated cyberattacks but rather "daft stuff" that could have been identified through routine IT health checks, indicating a fundamental lack of cyber hygiene.
The scope of these discoveries was broad, affecting various critical departments. For instance, vulnerabilities were found in the Department of Education's code, including a procurement service used by schools and a teacher application service that contained sensitive personal details, qualifications, employment history, and identity documents. Additionally, a flaw in a Scottish Government open data portal could have allowed visitors to read administrative account information and alter site configurations, demonstrating the pervasive nature of these security oversights.
The Planning Inspectorate
The most severe vulnerability identified by Nesbitt-Smith was at the Planning Inspectorate, an agency responsible for land-use matters across England. Here, "god-tier" Microsoft Entra ID credentials were accidentally committed to a public GitHub repository and not fully removed, creating an extremely dangerous exposure. The fact that these credentials offered such extensive access and seemingly did not expire compounded the risk, making the accidental publication particularly perilous for the agency.
These exposed credentials would have granted read and write access to all SharePoint sites and private employee OneDrive accounts, including sensitive HR records. Furthermore, they provided access to critical libraries safeguarding evidence under legal hold for statutory planning inquiries and appeals, presenting a clear opportunity for ransomware attacks or widespread data theft. The Planning Inspectorate, however, stated that its cyber monitoring tools immediately detected Nesbitt-Smith’s activity and that the vulnerability was fixed within 20 minutes of his report, with no data breach confirmed.
Open Source Debate
The UK government has maintained a policy of openly publishing code produced with public money for about a decade, driven by principles of transparency and cost-efficiency through code reuse. However, the recent acceleration of vulnerability discovery by AI models has sparked a debate about the wisdom of this open-source approach for public sector departments. The NHS, for example, reportedly ordered its technology teams to transition away from open-source code in May due to AI-related security concerns.
Nesbitt-Smith argues against simply closing public repositories without addressing the underlying security issues. He contends that such a move would be the "worst case scenario," as it would prevent ethical researchers like him from identifying flaws while adversaries, who likely have already mirrored these repositories, would retain access. He suggests that closing access without fixing problems might inadvertently draw more attention to hidden vulnerabilities, creating a false sense of security and hindering proactive defense efforts.
Key points
- Over 100 serious vulnerabilities were found across UK government codebases using consumer-grade AI models.
- The most critical flaw exposed "god-tier" access to sensitive data, including HR records and legal evidence, at the Planning Inspectorate.
- Vulnerabilities were attributed to poor cyber hygiene and neglected maintenance, not sophisticated attacks.
- The incident has fueled debate over the UK government's policy of openly publishing source code.
- Researchers warn that closing public repositories without fixing issues could worsen security by hiding flaws from ethical hackers.
The rapid discovery and remediation of these vulnerabilities, partly thanks to AI-assisted research, demonstrate the potential for technology to enhance cybersecurity by quickly identifying weaknesses before malicious actors exploit them. This incident could prompt the UK government to significantly improve its cyber hygiene and invest in more proactive security measures.
The widespread nature and basic detectability of these "god-tier" vulnerabilities suggest a deep-seated neglect of cybersecurity best practices within UK government departments. The debate around closing open-source repositories, if mishandled, could lead to a false sense of security, making it harder for ethical researchers to find flaws while leaving them exposed to determined adversaries.
