On May 14, 2026, the UK’s Government Digital Service (GDS) and the Department for Science, Innovation and Technology (DSIT) published guidance on GOV.UK titled “AI, open code and vulnerability risk in the public sector.” It tackles a question that suddenly turned sharp: when AI can find vulnerabilities at machine speed, should the public sector keep publishing its source code? The answer is blunt — keep open by default. Three days later, Simon Willison and Terence Eden spelled out what the document never says outright: this was a public rebuke of NHS England, delivered without naming it.
The trigger was an internal NHS England guidance note, SDLC-8, issued on April 29. Eden revealed it in a May 1 post: NHS England is preparing to close nearly all of its open source repositories, reversing years of “code in the open” commitments. A senior NHS England technical figure put it this way: “We are obviously looking at things like Mythos, which is more sophisticated at finding vulnerabilities,” and “Most of our repos, unless they’re essential, will be removed for security reasons.”
From SDLC-8 to Pulling the Repos
Eden, a former GDS, NHSX, and i.AI technologist, catalogued the policies this contradicts: point 3 of the UK Technology Code of Practice, the Service Manual, DHSC’s “Data saves lives” policy (commitment 601, completed May 2022), NHS Digital’s Software Engineering Quality Framework, and points 12–13 of the NHS Service Standard. The scale is not trivial either — thousands of NHS repositories on GitHub, with tens of thousands of NHS web pages linking into them.
He also attacked the premise that open equals dangerous. The Covid contact tracing app was open sourced, ran on millions of phones, and produced zero security incidents. Neither the National Cyber Security Centre (NCSC) nor the AI Safety Institute recommends closing repositories. Eden has backed up every NHS repo himself, noting that most licenses permit republication if the originals disappear. He filed an FOI request; a petition, an FSFE statement, and New Scientist coverage followed.
The Trigger: AI Vulnerability Discovery Got Fast
What spooked NHS England is Anthropic’s Claude Mythos Preview. The model was never publicly released; instead it went to vetted partners — AWS, Apple, Microsoft, Google, and the Linux Foundation — through Project Glasswing, for vulnerability detection and penetration testing. The output: thousands of high-severity flaws, including some in every major operating system and web browser. The GDS guidance cites official assessments pointing the same direction — the AI Security Institute’s Frontier AI Trends report from December 2025 found “materially-stronger cyber capability in controlled evaluations,” and AISI published a dedicated evaluation of Mythos Preview on April 13.
The other side of the ledger matters too: attackers are using AI as well. On May 12, Google’s Threat Intelligence Group confirmed the first AI-developed zero-day used to bypass 2FA, which a criminal group planned to abuse at scale. GDS’s framing: the window between discovery and exploitation is shrinking.
GDS Pushes Back: Keep Open by Default
The May 14 guidance makes four moves. First, meet a minimum standard for public systems — clear ownership, secure-by-design practice, automated hygiene, and real remediation capability, because “privacy should not be used as a substitute control.” Second, the core position in one line: “Keep open by default,” since making everything private adds delivery and policy costs and reduces reuse and scrutiny. Third, make exceptions explicit: any closure needs a short threat model naming the attacker, what publication adds, and a realistic harm path — and exceptions must stay narrow, time-bound, and periodically re-approved. Fourth, strengthen remediation: patch SLAs, automated dependency and vulnerability management, and fast handling of inbound reports.
Two sentences deserve verbatim quoting. “Publishing source code does not create those weaknesses” — weaknesses come from unpatched flaws and insecure configuration, not from visibility. And: “Making code private is not an appropriate mitigation for lack of ownership, patching capability, or operational assurance.”
Why Closing Repos Is Bad Security
GDS wrote the common failure modes into official policy. Closure invites security by obscurity and lowers the urgency to fix root problems. Already-published code has been mirrored, forked, and indexed — shutting the original repo takes nothing back. Closure is a “one-way door”: as private and public versions diverge, safe re-publication gets harder over time. Eden adds the practical point: AI tooling works just as well against binaries and live services, so attackers never needed the source in the first place.
What It Means for the Public Sector — and Everyone Else
Strip away the Whitehall drama and the guidance is a copy-ready governance checklist: every repo needs a named owner and maintenance plan (CODEOWNERS), a security contact (a SECURITY file and a monitored mailbox), no secrets or internal endpoints, automated dependency updates and secret scanning, and demonstrable patch timelines for critical and high vulnerabilities. That list works for any organization, public or private.
The bigger lesson is structural. When AI compresses the time between a weakness existing and being exploited, hiding code stops mattering and patch speed becomes the whole game. Eden read the unnamed guidance through civil service culture — GDS inviting the NHS to “a meeting without biscuits.” When internal disagreement goes public like this, it is itself the best measure of how hot the argument got.
Sources
- AI, open code and vulnerability risk in the public sector — GOV.UK
- The NHS goes to war against open source — Terence Eden
- GDS weighs in on the NHS’s decision to retreat from open source — Simon Willison
AI-assisted summary compiled from the sources above, reviewed by a human before publishing.