Summary: DSIT and GDS issued public-sector guidance on May 14, 2026 saying code should remain open by default after NHS England’s internal plan to close most repositories over AI-assisted vulnerability discovery. The guidance treats closures as narrow exceptions and says private code is not a substitute for ownership, patching capability, or operational assurance. The practical response is faster remediation, secrets hygiene, named owners, and auditable patch timelines.
Once AI can hunt for bugs at machine speed, should the public sector still publish its source code? Guidance titled “AI, open code and vulnerability risk in the public sector” landed on GOV.UK on May 14, 2026, issued jointly by the Department for Science, Innovation and Technology (DSIT) and the Government Digital Service (GDS) — and it answers: code stays open by default. When Simon Willison and Terence Eden picked the story up three days later, they said the unsaid part out loud: the rebuke is public, and the target is NHS England.
The story starts with SDLC-8, a note issued inside NHS England on April 29. Eden’s May 1 post laid out its contents: NHS England means to shut all but a handful of its open source repositories, scrapping a years-long “code in the open” commitment. A senior technical figure at NHS England had this to say: “We are obviously looking at things like Mythos, which is more sophisticated at finding vulnerabilities,” and “Most of our repos, unless they’re essential, will be removed for security reasons.”
How an Internal Note Turned Into a Mass Repo Shutdown
Eden — a former technologist at GDS, NHSX, and i.AI — listed the policies the plan collides with: point 3 of the UK Technology Code of Practice; the Service Manual; DHSC’s “Data saves lives” policy (commitment 601, completed May 2022); NHS Digital’s Software Engineering Quality Framework; as well as points 12–13 of the NHS Service Standard. The footprint is large, too: on GitHub, NHS maintains thousands of repositories, and NHS web pages numbering in the tens of thousands link into them.
His answer to the “open means danger” premise: the Covid contact tracing app was built in the open, landed on millions of phones, and never produced a single security incident. The National Cyber Security Centre (NCSC) hasn’t called for closures, and neither has the AI Safety Institute. Eden has stashed copies of every NHS repo himself and notes the code could be republished under most licenses if the originals vanished. He has lodged an FOI request too; since then have come a petition, an FSFE statement, and coverage from New Scientist.
What Lit the Fuse: AI’s Bug-Hunting Took a Leap
What rattled NHS England is Claude Mythos Preview, Anthropic’s unreleased model. It never shipped publicly; through Project Glasswing it reached vetted partners — AWS, Apple, Microsoft, Google, and the Linux Foundation — and was put to work on vulnerability detection and penetration testing. The yield: thousands of high-severity flaws, some in every major operating system and web browser. Assessments cited in the guidance agree: the December 2025 Frontier AI Trends report from the AI Security Institute recorded “materially-stronger cyber capability in controlled evaluations,” and AISI followed on April 13 with an evaluation dedicated to Mythos Preview.
Attackers hold the same cards: Google’s Threat Intelligence Group drove the point home on May 12, confirming the first AI-developed zero-day used to bypass 2FA — one a criminal group was plotting to abuse at scale. GDS’s reading: the gap separating discovery from exploitation keeps narrowing.
The GDS Answer: Openness as the Default
Four moves carry the document. First, a floor for public systems: ownership clearly assigned, secure-by-design practice, hygiene handled by automation, real remediation muscle — the point being that “privacy should not be used as a substitute control.” Next, the core stance in three words: “Keep open by default,” because privatizing everything raises the cost of delivery and of policy while eroding reuse and outside scrutiny. Third, closures count only as exceptions: each needs a compact threat model — who the attacker is, what publishing adds, how harm would realistically happen — and has to stay narrow, time-limited, and re-approved at intervals. Last, fix things fast: patch SLAs, automation around dependencies and vulnerabilities, quick handling of incoming reports.
Two sentences earn word-for-word quotation. “Publishing source code does not create those weaknesses” — the source of those flaws is unpatched bugs and insecure configuration, not visibility. And: “Making code private is not an appropriate mitigation for lack of ownership, patching capability, or operational assurance.”
The Security Case Against Closing Repositories
The document turns the standard mistakes into explicit warnings. Shut the code and you drift toward security by obscurity while dulling the urgency of fixing the root problem. Whatever has already been published exists as mirrors and forks, indexed far beyond the original — closing that original recovers nothing. It is a “one-way door,” too: the longer the private and public copies diverge, the harder it gets to reopen safely. Eden’s practical footnote: tooling like this hits binaries and live services just as hard, so the source was never a prerequisite for attackers.
Takeaways for the Public Sector, and for Developers Too
Look past the infighting and the document doubles as a governance checklist ready to copy: an owner, by name, with a maintenance plan per repo (CODEOWNERS); a reachable security contact (a SECURITY file with a monitored mailbox); nothing sensitive inside — no secrets, no internal endpoints; updates to dependencies plus secret scanning, all automated; and, for critical and high vulnerabilities, patch timelines you can actually show. None of it is public-sector-only; a private company could run the same list.
The lesson that matters more is structural: once AI crushes the lag between a flaw’s existence and its exploitation, concealment stops buying anything and patch speed decides the outcome. Eden, glossing the unnamed document in civil-service terms, read it as an invitation from GDS to the NHS: “a meeting without biscuits.” That this row surfaced in public at all tells you how hot it had run.