Planning Inspectorate

Security researcher Chris Nesbitt-Smith of ControlPlane used consumer-grade Claude Opus and Sonnet models running on a laptop to scan publicly released UK government code, uncovering over 100 serious vulnerabilities. The most severe case involved the Planning Inspectorate, where Microsoft Entra ID credentials leaked to GitHub retained broad, seemingly non-expiring access to all SharePoint sites and staff OneDrive accounts. The episode shows AI has sharply lowered the barrier to vulnerability discovery, while the real bottleneck is government credential hygiene and remediation capacity.