NHS England rushes to hide software over AI hacking fears

New Scientist · rss · 2026-05-18 Reader 🖥️

AI Regulation & Governance (External)AI-Driven Vulnerability Discovery Frontier-Lab Hype Mythos Public-Sector Digitalization

NHS England has reversed its long-standing 'open by default' policy for publicly funded code, citing fears that Anthropic's code-analysis AI 'Mythos' could be used to find exploitable flaws — a move that security experts and former civil servants characterize as evidence-light, counterproductive, and harmful to the transparency on which public-sector accountability depends.

practical · news report — A short investigative news piece reporting a specific NHS England policy reversal. It is practical in form (what was decided, by whom, with what justification, with what objections) and adopts an implicit critical stance: it foregrounds expert dissent (AISI, Terence Eden) and historical counterexamples (Horizon scandal) that frame the policy as ill-considered.

Structure

Part	Role
Lede: NHS England rushes to withdraw all its software from public view citing AI hacking risk	Frames the story as a hurried, sweeping policy reversal — establishes tone of urgency and overreach
Background: previous NHS standard required publicly funded code to be open-source	Establishes the baseline norm the new policy departs from and the rationale (reuse, transparency) that is being abandoned
New guidance text: 'private by default,' deadline 11 May, Mythos named as cause	Documentary evidence of the policy and its stated rationale
AISI counter-evidence on Mythos capability	Undermines the stated rationale by citing the government's own AI capability evaluator
Horizon scandal as accountability counterexample	Argues from a vivid case that closed code enables prolonged public harm
Terence Eden's critique: hype-driven, illogical, and futile	Expert voice consolidates the critique — open source is more secure (many eyes), code is already mirrored, NHS code is mostly not security-critical
NHS England's official response	Allows the institution to frame the move as 'temporary' and reviewable; the article positions this against the sweeping language of the actual guidance

Key terms

Mythos Mythos
An Anthropic AI model reported as capable of discovering flaws in virtually any software through large-scale code ingestion, inference, and reasoning — the specific threat NHS England names as justification for closing its repositories.
default-closed posture AI-Driven Vulnerability Discovery
NHS England's new stance that all source code repositories are private unless an exceptional, formally approved case is made for publication — the inversion of the previous 'open by default' standard.
NHS service standard (open-source clause)
The pre-existing rule that publicly funded code should be open-source unless there is a good reason otherwise, justified by reuse efficiency and transparency.
AI Security Institute (AISI) AI Regulation & Governance (External)
A UK government-backed body that evaluates frontier AI capabilities, including cyber-offensive use; its assessment of Mythos is used in the article to undercut NHS England's premise.
security through obscurity AI-Driven Vulnerability Discovery
Implicit concept the article critiques: the belief that hiding source code meaningfully reduces exploitable risk in a world where the code already exists in mirrors and where peer review surfaces flaws.

Propositions

explicitNHS England has issued guidance requiring all source code repositories to be private by default, with a deadline of 11 May.conf: high
explicitThe guidance explicitly names Mythos and rapid AI advancements as the rationale.conf: high
explicitThe NHS service standard previously required publicly funded code to be open-source to enable reuse and transparency.conf: high
explicitcontestedThe UK AI Security Institute evaluated Mythos and found it only capable of attacking small, weakly defended, vulnerable enterprise systems.conf: high
contradictsThe Trump administration's AI doomer moment · p2 — UK AISI's evaluation found Mythos only capable of attacking small, weakly defended systems — undercutting the national-security-risk framing of its cyber capabilities.
explicitBecause NHS code has been public for years, copies persist in backups and downloads regardless of withdrawal.conf: high
explicitOpen-source code is generally more secure because many reviewers can find flaws.conf: high
explicitMost NHS software is not security-critical.conf: high
explicitHad the Horizon system's code been public, the Post Office scandal might not have continued for years.conf: medium
explicitThe NHS England decision is driven by hype rather than analysis.conf: high
explicitThe withdrawal is a temporary measure pending assessment of AI developments.conf: high
implicitClosing publicly funded code weakens public accountability for public-sector IT.conf: high
implicitFrontier-AI risk discourse can produce sweeping institutional decisions that outrun the underlying evidence.conf: high

Arguments

NHS England's privatization of its code is unnecessary and counterproductive. strength: high

Explicit premises:

AISI's evaluation indicates Mythos is not a realistic threat to well-defended systems
Most NHS software is not security-critical
Public copies of the code already exist in mirrors and backups
Open-source review by many eyes is itself a security mechanism

Implicit premises:

Security policy should be calibrated to demonstrated capability and marginal risk reduction, not to hype
The benefits of openness (reuse, transparency, audit) are concrete and ongoing, while the security benefit of closure is speculative and likely negligible

Inferences:

Privatization produces real costs (lost reuse, lost transparency) without delivering the claimed security gain
A targeted approach (closing genuinely sensitive repos, leaving the rest open) would dominate the blanket policy

Default-closed posture for NHS code weakens public accountability. strength: medium

Explicit premises:

Public services built with public money have a transparency claim on their code
The Horizon scandal illustrates how closed code shields systemic harm for years

Implicit premises:

Transparency is a precondition for accountability in public IT
Once accountability infrastructure is removed, restoring it is institutionally hard

Inferences:

Future scandals analogous to Horizon become harder to surface if NHS systems' code is invisible to outside scrutiny
The accountability cost of closure is structural, not merely operational

The policy reflects panic rather than analysis. strength: medium

Explicit premises:

The guidance text uses broad language about 'rapid advancements' rather than specific threat modeling
Civil servants and observers report confusion about the goal
The deadline is short and the move sweeping rather than targeted
The named threat (Mythos) is contradicted by the government's own evaluator (AISI)

Implicit premises:

Sound security policy is targeted, evidenced, and proportionate
A policy that contradicts the assessment of one's own specialist agency is presumptively political or reactive

Inferences:

Similar AI-hype-driven reversals are likely in other public-sector bodies unless an evidentiary norm is enforced
The episode suggests an institutional failure mode worth naming: 'defensive AI-risk theatre'

Narratives

The Post Office Horizon scandal — innocent sub-postmasters prosecuted for alleged theft and fraud because a flawed IT system's code and behavior were not open to scrutiny.
→ Functions as the moral and evidential anchor for the openness-equals-accountability claim. Implies that closing NHS code today plants the seeds for an equivalent future scandal.
AI as existential cyber-offensive threat — a Mythos-shaped story in which frontier models invalidate prior security assumptions wholesale.
→ The narrative the policy rides on; the article works to undermine it by introducing AISI's narrower empirical assessment.
Open source as civic infrastructure — publicly funded code as a commons that enables reuse, lowers duplication, and embeds transparency.
→ Names what is being lost. Frames openness as a positive obligation, not just a default — so closure isn't neutral, it is a withdrawal from a public commitment.
Bolting the stable door after the horse has gone — institutional gestures of control over things that have already left institutional reach.
→ Compact image that delegitimizes the policy as performative. Shifts the reader from 'is this risk real?' to 'even if real, is this response coherent?'

Questions addressed

✅ What policy change has NHS England made, when, and why?
All NHS England code repositories must become private by default by 11 May, citing AI code-ingestion threats and specifically Mythos.
✅ Is the stated AI threat credible as a justification for this sweeping policy?
Per the UK's own AI Security Institute, no — Mythos is currently effective only against weakly defended systems.
✅ Will privatization meaningfully reduce risk, given that code copies already exist?
No — the code is already mirrored and downloaded; the gesture cannot reach what's already public.
✅ What are the costs of reversing the open-source default?
Lost reuse efficiency, lost transparency, weakened public-sector accountability (illustrated by the Horizon counterexample).
⭕ What threat model and approval process produced this guidance?
Not addressed — the article does not identify decision-makers, the analysis behind the guidance, or what 'exceptional need' for public access will mean in practice.
⭕ Which repositories or what fraction of NHS code is genuinely security-sensitive enough to warrant closure?
Not addressed — the article treats the policy as monolithic and does not engage the possibility that a narrower closure might be defensible.
⭕ How are peer public-sector bodies (GDS, US 18F, EU institutions) responding to AI code-ingestion risk?
Not addressed — no comparative baseline is provided.

Gaps

incompleteThe article does not identify who within NHS England drove the decision, what threat-modeling process was used, or what alternatives were considered. Without that, the 'panic' reading remains plausible but unproven; it could equally be a political-blame-avoidance maneuver dressed in security language.
Read next: FOI requests or follow-up reporting; literature on institutional risk aversion (e.g., Wildavsky on risk and culture; Power's 'Risk Management of Everything')
incompleteThe Mythos capability claim is reported via prior coverage rather than reassessed; the article leans on AISI's summary without unpacking the evaluation methodology or scope.
Read next: The AISI blog post linked in the article; Anthropic's own model cards and red-team disclosures; broader work on cyber-offensive AI capability evaluation
incompleteNo quantification of what's lost: how many repos, how much downstream reuse, what value to other organisations. The cost side of the cost-benefit framing is asserted rather than measured.
Read next: GDS impact assessments of public-sector open source; UK GovTech case studies; academic work on the economic value of open-source code
incompleteNo engagement with intermediate options between fully open and fully closed — selective redaction, embargoed releases, signed binaries with private build pipelines, hash-based attestations. The frame is binary, which makes the criticism easier but flattens the design space.
Read next: Threat-model literature; the OpenSSF and CNCF supply-chain security playbooks
incompleteThe article implies but does not develop a structural claim: that frontier-AI hype is producing a class of institutional decisions that withdraw from civic transparency commitments. The NHS case may be one of many; without comparable cases the claim is anecdote rather than pattern.
Read next: Survey other public-sector responses (national libraries, statistical offices, parliamentary IT) to AI scraping/ingestion; broader literature on 'AI moral panics' and their institutional consequences

Closes gaps elsewhere

The Trump administration's AI doomer moment · g1 — Reports the UK AI Security Institute's evaluation of Mythos — capable only of attacking small, weakly defended, vulnerable enterprise systems — supplying the capability detail needed to assess the proportionality of the government's reaction.

NHS England rushes to hide software over AI hacking fears

Structure

Key terms

Propositions

Arguments

Narratives

Questions addressed

Gaps

Closes gaps elsewhere

Related documents