GDS Explicitly Rebuts NHS Decision to Close Open Source Repos Over AI Fear — 'Does Not Remove Underlying Weaknesses'

Simon Willison's Blog·medium signal

The UK Government Digital Service published guidance titled 'AI, open code and vulnerability risk in the public sector' that directly repudiates NHS England's April decision (SDLC-8) to make all source code repositories private by May 11 over fears of Anthropic's Mythos model finding zero-day vulnerabilities. GDS states that moving code from public to private 'reduces sharing and scrutiny, can slow coordinated improvement across government, and does not remove the underlying weaknesses.' Simon Willison's coverage calls the GDS response a forensic evisceration of the NHS's position.