Bug Bounty

AI-aided researcher finds 100+ flaws in UK government code

A ControlPlane researcher found 100+ flaws in UK government code and used the unpaid GC3 VDP for cases including a live Planning Inspectorate secret.

Illustration of a bug icon over code with the headline 100+ flaws found in UK government code

A ControlPlane researcher used off-the-shelf Claude models to find more than 100 serious flaws in public UK government code, reporting cases including the most serious through the government’s unpaid disclosure channel. The worst, a live Planning Inspectorate cloud secret, was revoked within about 20 minutes, which is a rare good-news story for public sector vulnerability disclosure.

What happened

On 10 November 2026, WIRED reported that Chris Nesbitt-Smith, a researcher at the UK consultancy ControlPlane, had scanned 349 public sector codebases belonging to 33 organisations and found weaknesses in roughly two thirds of them. He told the magazine that he worked from a laptop using Anthropic’s Claude Opus and Sonnet models, and that much of what turned up should have been caught by an ordinary IT health check. His own summary of the findings was blunt: “It’s all daft stuff.”

ControlPlane has published write-ups for several cases. The most serious involved the Planning Inspectorate, which handles planning appeals and inquiries in England. Others affected two Department for Education services and a Scottish Government open data portal. WIRED says every organisation involved has since dealt with the problems.

What makes this a disclosure story is the route the reports took. The Planning Inspectorate finding was filed on HackerOne under the vulnerability disclosure policy run by the Government Cyber Coordination Centre (GC3), a channel open to anyone reporting a public sector flaw. The Scottish issue went through the Scottish Government’s own policy, with SC3, Scotland’s cyber coordination centre, brought in. Nobody was paid: GC3 states plainly that it offers no monetary rewards.

The technical picture

The Planning Inspectorate case is a textbook secrets failure. ControlPlane says a complete Microsoft Entra ID application credential (client ID, tenant ID and client secret) sat in plain text inside an exported Azure Synapse notebook used to pull monthly HR extracts from SharePoint. Someone later removed the file with a force push, but GitHub keeps serving orphaned commits through its raw content service, so the secret stayed retrievable for around 18 months.

The credential was still live, did not appear to expire and carried tenant-wide Sites.ReadWrite.All and Files.ReadWrite.All permissions with admin consent. In practice that meant read and write access to every SharePoint site and private employee OneDrive in the tenant, including preservation libraries that hold evidence for statutory planning appeals. ControlPlane scored it CVSS 10.0.

ControlPlane’s scanner flagged the credential as live at 05:45 on 26 August; the report went in at 12:10 and the secret was deleted roughly 20 minutes later. The agency told WIRED its monitoring had already spotted the activity and opened an incident before contact, and that it found no breach.

The Scottish portal, a React front end on CKAN, had a long-lived admin API token compiled into its public JavaScript (CVSS 9.8). Reported on 23 June, it was decommissioned two days later. The DfE teacher service could overwrite an existing sign-in association when linking GOV.UK One Login by email match (CVSS 7.4), and was corrected by early August.

Timeline of the Planning Inspectorate disclosure on 26 August 2026, from secret detection to revocation and briefing

Why it matters for UK organisations

Three points stand out. First, the GC3 channel worked. A critical finding went from report to revocation in well under an hour, with a technical briefing for the researcher that afternoon. Many firms with paid bounties do worse.

Second, the researcher’s legal position remains uncomfortable. GC3’s policy tells reporters not to “break any applicable law or regulations” and not to modify data. ControlPlane went beyond spotting a string: it obtained a token with the leaked secret, read column headers and row counts, and proved write access with a request built to fail on a name clash, changing nothing. It then gave the agency a full activity log. That is careful testing, but authenticating with someone else’s credential is exactly what the Computer Misuse Act 1990 targets. If a third party pursues a researcher, the policy promises only that GC3 may confirm they acted within its terms. In the Lords on 26 October, during debate on the Cyber Security and Resilience Bill, the government said the Home Office review had finished and that a statutory defence for accredited researchers would arrive in the coming National Security Bill. That is progress, but it is not yet law, and “accredited” leaves open whether an independent reporter using a public VDP would qualify. Until then, cases like this rely on goodwill.

Third, the findings feed the debate over whether public bodies should stop publishing code now AI makes scanning cheap; the NHS reportedly told teams in May to move away from open source. Nesbitt-Smith argues closing repositories without fixing them is the worst outcome, since adversaries have probably mirrored them. Amanda Brock, who runs the industry body OpenUK, told WIRED the Planning Inspectorate problem came down to poor housekeeping rather than any weakness in open source itself. GC3’s own AI hackathons this year produced 407 findings across nine departments for about £13,000 in tokens, so government knows how cheap this has become.

Expert view

In my experience, leaked cloud credentials in Git history are among the most common critical findings on any external engagement, and “we deleted the file” is the most common wrong answer. A secret that has touched a public repository is burnt. Rotation at the identity provider is the fix; rewriting history is cosmetic.

The more interesting lesson is about disclosure maturity. The Planning Inspectorate detected the activity, already had an incident running, and then engaged constructively with the person who reported it rather than treating them as a threat. That is what a good vulnerability disclosure programme looks like from the inside. The organisations that struggle usually have no security.txt, no triage owner and no plan for an unsolicited report arriving on a Friday evening.

I would not treat “consumer AI on a laptop” as the headline. The tooling made looking cheaper, but every one of these flaw classes predates large language models. Reports will now arrive in volume; the question is whether your intake and remediation can keep pace.

What to do now

  1. Revoke, then clean. Treat any secret ever committed to a public repository as compromised. Rotate it at the identity provider first. This maps to the Cyber Essentials secure configuration and user access control themes.
  2. Scan full history, not just HEAD. Run secret scanning in pre-commit hooks and CI, and check that your tooling covers orphaned and unreachable commits.
  3. Cut service principal scope. Audit Entra ID app registrations for tenant-wide .All Graph permissions; use Sites.Selected, short secret lifetimes and, where possible, workload identity in place of static secrets.
  4. Publish a disclosure route. Add a security.txt, name a triage owner and, for public bodies, signpost the GC3 Vulnerability Reporting Service. Say clearly how you will treat good-faith researchers.
  5. Do not hide code as a fix. If you take repositories private, fix the flaws first; assume copies already exist.

Bottom line

A single researcher with commodity AI found more than 100 serious weaknesses in public UK government code, and the unpaid GC3 disclosure route handled the worst of them quickly and well. The technical failures were basic. The unresolved risk is legal: researchers who validate such flaws carefully still depend on discretion rather than statute, and that needs fixing alongside the code.

Sources

Related Posts