Today for AI
HOT RADAR
industryHEAT 11.6°

AI CURATED HOT STORY · 11/10/2026

Researcher Uses Claude to Find Over 100 Critical Flaws in UK Government Code

1 reports archived1 independent sourcesupdated 11/10/2026, 16:03:58
Synthesis & Latest Updates
1 Sources Cross-Validated

Security researcher Chris Nesbitt-Smith of ControlPlane used consumer-grade Claude Opus and Sonnet models running on a laptop to scan publicly released UK government code, uncovering over 100 serious vulnerabilities. The most severe case involved the Planning Inspectorate, where Microsoft Entra ID credentials leaked to GitHub retained broad, seemingly non-expiring access to all SharePoint sites and staff OneDrive accounts. The episode shows AI has sharply lowered the barrier to vulnerability discovery, while the real bottleneck is government credential hygiene and remediation capacity.

LATEST/Security researcher Chris Nesbitt-Smith of ControlPlane used consumer-grade Claude Opus and Sonnet models running on a laptop to scan publicly released UK government code, uncovering over 100 serious vulnerabilities. The most severe case involved the Planning Inspectorate, where Microsoft Entra ID credentials leaked to GitHub retained broad, seemingly non-expiring access to all SharePoint sites and staff OneDrive accounts. The episode shows AI has sharply lowered the barrier to vulnerability discovery, while the real bottleneck is government credential hygiene and remediation capacity.

Hourly heat curve

2 fully observed hours
Fewer than 3 fully observed hours; trend not plotted yet.

Coverage timeline

Total 1 reports · Latest first
  1. IT之家 · IT业界T2·72 pts

    Researcher Uses Claude to Find Over 100 Critical Flaws in UK Government Code

    • Claude Opus and Sonnet running on a laptop surfaced over 100 serious flaws, mostly basic errors detectable by routine checks
    • The Planning Inspectorate leaked high-privilege Microsoft Entra ID credentials to GitHub without full revocation, exposing all SharePoint sites and private OneDrive accounts
    • The debate is less about open code than about least privilege, credential rotation and timely remediation