Backlash grows after NHS England moves to pull open-source code over AI hacking fears

Critics say secrecy is not security

The strongest objection is technical rather than ideological. Experts quoted in the report say withdrawing code from public repositories will not meaningfully improve security. If AI tools can help identify vulnerabilities, defenders can use them as well. More importantly, keeping software private does not remove the flaws; it only changes who can inspect them.

Vlad-Stefan Harbuz of the University of Edinburgh, a co-author of the open letter, said his group had used Mythos to scan open-source NHS code and found a small number of relatively severe vulnerabilities, which were responsibly disclosed before the current policy shift. That detail complicates the story. It suggests the threat is real enough to produce actionable findings, but also supports the critics’ argument that auditing and remediation, not concealment, are the practical responses.

A larger question about public software in the age of AI

The NHS case exposes a broader dilemma that many public institutions will face. Open-source software has long been defended on grounds of efficiency, interoperability, accountability, and security through scrutiny. AI-assisted code analysis changes the economics of scrutiny by lowering the cost of finding bugs for both defenders and attackers. The question is whether that shift invalidates the old open-source logic or makes disciplined maintenance even more important.

NHS England appears to be acting on the assumption that public visibility now creates too much risk. Opponents argue the opposite: when AI makes vulnerability discovery easier, the answer is stronger patching, auditing, and governance, not retreat from openness.

Why this matters beyond the NHS

The fight will matter outside British healthcare because governments everywhere are re-evaluating digital risk under the pressure of increasingly capable AI tools. If a major public institution decides that code openness is no longer tenable, others may follow. If the backlash succeeds, it may reinforce the idea that transparency remains compatible with stronger security, provided institutions invest in modern defensive practices.

For now, NHS England has turned a technical security concern into a high-profile policy test. The underlying fear is understandable: AI may make it easier to find flaws at scale. But critics are pressing a harder question. Is hiding code a genuine defense, or merely a visible reaction to a fast-moving threat? The answer could shape how public sector software is governed well beyond the NHS.

This article is based on reporting by New Scientist. Read the original article.