Today for AI
HOT RADAR
industryHEAT 7.6°

AI CURATED HOT STORY · 11/10/2026

Researcher Uses Claude to Find Over 100 Critical Flaws in UK Government Code

1 reports archived1 independent sourcesupdated 11/10/2026, 16:03:58
Synthesis & Latest Updates
1 Sources Cross-Validated

Security researcher Chris Nesbitt-Smith of ControlPlane used consumer-grade Claude Opus and Sonnet models running on a laptop to scan publicly released UK government code, uncovering over 100 serious vulnerabilities. The most severe case involved the Planning Inspectorate, where Microsoft Entra ID credentials leaked to GitHub retained broad, seemingly non-expiring access to all SharePoint sites and staff OneDrive accounts. The episode shows AI has sharply lowered the barrier to vulnerability discovery, while the real bottleneck is government credential hygiene and remediation capacity.

LATEST/Security researcher Chris Nesbitt-Smith of ControlPlane used consumer-grade Claude Opus and Sonnet models running on a laptop to scan publicly released UK government code, uncovering over 100 serious vulnerabilities. The most severe case involved the Planning Inspectorate, where Microsoft Entra ID credentials leaked to GitHub retained broad, seemingly non-expiring access to all SharePoint sites and staff OneDrive accounts. The episode shows AI has sharply lowered the barrier to vulnerability discovery, while the real bottleneck is government credential hygiene and remediation capacity.

Hourly heat curve

19 fully observed hours
Now
7.6
Peak
11.717:00
24h change
-35%

The line compares only sources observed throughout; gap hours are interpolated to keep the trend continuous.

Coverage timeline

Total 1 reports · Latest first
  1. IT之家 · IT业界T2·72 pts

    Researcher Uses Claude to Find Over 100 Critical Flaws in UK Government Code

    • Claude Opus and Sonnet running on a laptop surfaced over 100 serious flaws, mostly basic errors detectable by routine checks
    • The Planning Inspectorate leaked high-privilege Microsoft Entra ID credentials to GitHub without full revocation, exposing all SharePoint sites and private OneDrive accounts
    • The debate is less about open code than about least privilege, credential rotation and timely remediation