UK Government Finds 400+ Vulnerabilities in AI Hackathons

The UK Government Cyber Coordination Centre ran in-person hackathons using frontier and near-frontier AI models to scan open-source repositories across nine departments, producing 407 findings including critical flaws (authentication bypass, data exposure, remote code execution) and some zero-days. Teams combined traditional scanners with AI-assisted triage and agentic pipelines to validate and prioritize findings; all exploitable high/critical issues were remediated with no evidence of exploitation, and the programme cost approximately £13,000 in tokens. The report notes lessons about using models as scoped pipeline components, the importance of human expertise and triage, and raises questions about the impact of a new US export ban on certain models.