Over 100 Critical Security Flaws Found in UK Government Systems
Critical Security Flaws in UK Agencies
More than 100 serious security vulnerabilities have been identified in software code publicly released by UK government agencies. The issue, primarily linked to poor system maintenance and failures in cyber hygiene, poses a direct threat to sensitive citizen data. The investigation, conducted by security specialist Chris Nesbitt-Smith, utilised artificial intelligence models—specifically Claude Opus and Sonnet. According to the researcher, the process required no complex technology; a standard laptop and basic IT auditing were sufficient to uncover flaws that agencies had failed to address in a timely manner.
'God-Tier' Access and Potential Risks
The most alarming incident involved the Planning Inspectorate. The agency mistakenly uploaded access credentials to a public GitHub repository, granting potential attackers total control over the system. Nesbitt-Smith explained that these credentials provided what is known as "god-tier" access to Microsoft Entra ID. This would have allowed hackers to access, modify, or encrypt all SharePoint files, personal OneDrive accounts, HR records, and sensitive information related to legal disputes for ransom purposes.
Despite this, representatives from the Planning Inspectorate stated that their monitoring systems detected the researcher's activity in August. They claim the vulnerability was patched within 20 minutes and that no data breach occurred. However, similar issues were identified in other agencies, including the Department for Education, where significant flaws were found in the code for teacher applications and professional training registers.
Open Source or Internal Neglect?
The UK government has pursued an "open source" policy for a decade to improve transparency and optimise costs. However, in the era of artificial intelligence, where finding vulnerabilities has become significantly easier, criticism is intensifying. Some agencies, including the NHS, are already considering closing their code to mitigate security risks.
Experts warn the government that simply hiding the code will not solve the underlying problem. If fundamental system flaws are not rectified, closing the code will only draw attention and will not stop attackers who may have already copied the repositories. Specialists argue that the core issue is not the open-source principle itself, but the inefficiency of internal agency processes, which struggle to maintain technological infrastructure amidst financial constraints.