AI-Assisted Audit Reveals Critical Credential Leaks Across UK Government Repositories

A ControlPlane researcher leveraged Claude Opus and Sonnet models on a standard laptop to scan 349 public-sector codebases across 33 UK organizations. The automated review surfaced more than 100 serious flaws, most stemming from neglected maintenance rather than sophisticated attack vectors.

The most severe exposure occurred at the Planning Inspectorate, where a Microsoft Entra ID credential accidentally committed to GitHub provided full read-write access to SharePoint sites, employee OneDrive accounts, HR records, and legally held planning evidence. The credential had not expired, creating a direct path for ransomware or data theft.

The agency detected the researcher's activity within minutes, revoked the credential in 20 minutes, and confirmed no breach occurred. OpenUK's CEO emphasized the root cause was internal process failure, not open-source publishing itself.

Why it matters for GPU / AI infrastructure

This episode demonstrates how accessible AI models can accelerate vulnerability discovery — both for defenders and adversaries. For organizations running AI workloads on GPU clouds, securing credential pipelines, monitoring public repositories, and automating secret rotation become essential hygiene. AiGpu customers should enforce strict IAM policies, enable continuous scanning of infrastructure-as-code, and treat AI-assisted audits as a standard layer of defense.