NHS to close-source GitHub repos over AI, security concerns • The Register
NHS to close-source GitHub repos over AI, security concerns • The Register
https://www.theregister.com/2026/05/05/nhs_to_closesource_hundreds_of_repos/
Publish Date: 2026-05-05 05:15:00
Source Domain: www.theregister.com
The UK’s National Health Service (NHS) is ordering all of its technology leaders to temporarily wall off the organization’s open source projects over concerns relating to advanced AI and Anthropic’s Mythos.
According to guidance shared internally within the organization and seen by The Register, GitHub repositories must be set from public to private by May 11.
The guidance reads: “Public repositories materially increase the risk of unintended disclosure of source code, architectural decisions, configuration detail, and contextual information that may be exploited – particularly given rapid advancements in AI models capable of large-scale code ingestion, inference, and reasoning (e.g. developments such as the Mythos model).”
It also states GitHub repos should not be public “unless there is an explicit and exceptional need.” The decision was approved by the NHS’ Engineering Board.
An NHS England spokesperson told The Register this was merely a temporary measure enacted while the organization shores up its cybersecurity posture.
“We are temporarily restricting access to some NHS England source code to further strengthen cybersecurity while we assess the impact of rapid developments in AI models,” they said.
“We will continue to publish source code where there is a clear need.”
NHS sources told us very few of the hundreds of NHS open source repositories contain anything remotely sensitive. Examples of open repos include those dedicated to documentation, architecture diagrams, and codebases for internal tools, such as web apps for managing clinic times.
While there are bugs that an frontier AI model such as Mythos could unearth, there is thought to be very little risk to healthcare services.
The NHS’s decision to pull a curtain over its code does, however, mark a significant, albeit…
