Measures are temporary and precautionary, a spokesperson says

NHS England is moving to take down publicly accessible software repositories, citing concerns that emerging AI tools such as Mythos could be used to uncover and exploit vulnerabilities in its systems.

The public body has issued urgent new guidance instructing staff to remove internally developed software from public platforms.

The directive signals a shift away from long-standing policy that encouraged publicly funded software to be made open-source, allowing developers and organisations to reuse and improve it.

Under the new rules, "all source code repositories must be private by default," with public access permitted only in "explicit and exceptional" cases.

Staff have been given a deadline of 11 May to comply.

AI fears driving policy change

The NHS move is prompted by growing concern over advances in AI, particularly the model known as Mythos, developed by Anthropic. Mythos has been widely reported as capable of identifying software vulnerabilities at scale, raising fears that malicious actors could use such tools to target critical systems.

NHS England's internal guidance explicitly references the model, warning that public code repositories may expose "architectural decisions, configuration detail, and contextual information" that could be exploited by increasingly sophisticated AI systems.

"This red line establishes a default-closed posture for code," the guidance states, adding that the organisation is assessing the risks posed by rapid AI developments.

Experts question necessity

The government-backed AI Security Institute has previously evaluated Mythos and concluded it is primarily effective only against "small, weakly defended" systems.

It found no evidence that well-secured infrastructure would be at significant risk. Critics argue that removing open-source access may, in fact, undermine security rather than improve it.

Terence Eden, who has worked extensively on public sector transparency, described the move as "retrograde" and said he had submitted a Freedom of Information request to understand the reasoning behind it.

"I am convinced that closing all their excellent open-source work is the wrong move for the NHS," he said. "I hope they see sense and reverse course."

Eden acknowledged that AI tools like Mythos could identify bugs in code but questioned the real-world impact.

Transparency versus security

For years, NHS England followed its own service standard requiring publicly funded software to be open-source by default. The approach was intended to reduce duplication, cut costs and improve public trust.

Advocates of open-source development also argue that transparency allows more developers to scrutinise code, helping identify and fix vulnerabilities more quickly. Some point to past failures, such as the Horizon IT system, where a lack of transparency contributed to prolonged legal and operational issues.

Eden noted that much of the NHS's code has already been publicly available for years, meaning copies are likely to remain accessible regardless of the new restrictions.

In a statement, NHS England said the measures are temporary and precautionary.

"We are temporarily restricting access to some NHS England source code to further strengthen cyber security while we assess the impact of rapid developments in AI models," a spokesperson said.

"We will continue to publish source code where there is a clear need."