UK government code flaws found with AI, including Planning Inspectorate credentials exposed on GitHub
Security researcher Chris Nesbitt-Smith of ControlPlane used consumer-grade Claude models to scan 349 public sector codebases across 33 UK organizations and reported vulnerabilities in about two-thirds of them (wired.com). The most serious case was at the Planning Inspectorate, which accidentally committed a login to the public GitHub repository and had not fully removed it. The credentials reportedly gave wide access and did not appear to expire. According to the researcher, a full Microsoft Entra ID compromise would have given read and write access to all SharePoint sites and private employee OneDrive accounts, including HR records and evidence under legal hold. The agency says its monitoring detected the researcher's activity in August, that it fixed the flaw within 20 minutes of the report, and that it verified no data breach occurred (wired.com). The article reports no active exploitation by attackers, and the affected organizations have since dealt with the issues (wired.com). The researcher says most findings are basic and could have been caught by a routine IT health check.
Detalhes técnicos
- Exposed credentials: a login for the Planning Inspectorate was committed to a public GitHub repository and was not fully removed. Its wide scope and apparent lack of expiry made the exposure especially dangerous (wired.com).
- Identity takeover risk: the researcher says the complete Entra ID login would have allowed access to SharePoint, OneDrive, HR records and legal-hold evidence libraries (wired.com).
- Department of Education: flaws were found in a procurement service used by schools, a teacher application service holding personal details, qualifications, employment history and identity documents, and England's register of government-funded training providers and apprenticeships (wired.com).
- Scottish Government: a vulnerability in an open data portal would have let any visitor read administrative account information and change site configuration (wired.com).
- The article names no CVE identifiers and no specific vulnerability classes for these findings.
Remediação
- The organizations named in the article have fixed the issues, according to the article (wired.com). The Planning Inspectorate says it has reviewed and strengthened its systems and processes (wired.com).
- The researcher argues that closing public repositories without fixing the underlying flaws would be the worst option, because researchers cannot find them and adversaries may already have mirrored the code (wired.com).
- No vendor advisory, CVE or fixed version for these findings was located in the research for this record. The primary sources reviewed do not cover this story.
Linha do tempo
-
UK government code flaws found with AI, including Planning Inspectorate credentials exposed on GitHub
ler a análise desta fonte ocultar
Security researcher Chris Nesbitt-Smith of ControlPlane used consumer-grade Claude models to scan 349 public sector codebases across 33 UK organizations and reported vulnerabilities in about two-thirds of them (wired.com). The most serious case was at the Planning Inspectorate, which accidentally committed a login to the public GitHub repository and had not fully removed it. The credentials reportedly gave wide access and did not appear to expire. According to the researcher, a full Microsoft Entra ID compromise would have given read and write access to all SharePoint sites and private employee OneDrive accounts, including HR records and evidence under legal hold. The agency says its monitoring detected the researcher's activity in August, that it fixed the flaw within 20 minutes of the report, and that it verified no data breach occurred (wired.com). The article reports no active exploitation by attackers, and the affected organizations have since dealt with the issues (wired.com). The researcher says most findings are basic and could have been caught by a routine IT health check.
Technical Details
- Exposed credentials: a login for the Planning Inspectorate was committed to a public GitHub repository and was not fully removed. Its wide scope and apparent lack of expiry made the exposure especially dangerous (wired.com).
- Identity takeover risk: the researcher says the complete Entra ID login would have allowed access to SharePoint, OneDrive, HR records and legal-hold evidence libraries (wired.com).
- Department of Education: flaws were found in a procurement service used by schools, a teacher application service holding personal details, qualifications, employment history and identity documents, and England's register of government-funded training providers and apprenticeships (wired.com).
- Scottish Government: a vulnerability in an open data portal would have let any visitor read administrative account information and change site configuration (wired.com).
- The article names no CVE identifiers and no specific vulnerability classes for these findings.
Remediation
- The organizations named in the article have fixed the issues, according to the article (wired.com). The Planning Inspectorate says it has reviewed and strengthened its systems and processes (wired.com).
- The researcher argues that closing public repositories without fixing the underlying flaws would be the worst option, because researchers cannot find them and adversaries may already have mirrored the code (wired.com).
- No vendor advisory, CVE or fixed version for these findings was located in the research for this record. The primary sources reviewed do not cover this story.