NHS England has moved to limit access to software built with public money as fears grow that powerful AI systems could use open code to help launch cyberattacks.

The shift cuts against existing NHS rules, which state that software developed with public funds should be made publicly available. Reports indicate officials now worry that openly releasing code could hand advanced AI models a useful starting point for finding weaknesses, generating exploits, or accelerating hacking efforts. The concern centers on tools such as Mythos, which sources suggest have sharpened anxiety about how quickly AI can turn technical information into offensive capability.

Open code once signaled transparency and reuse; now, for some public agencies, it also looks like a security risk.

The change highlights a growing collision between two public-interest goals: openness and resilience. For years, governments and health systems pushed to share software so teams could improve it, adapt it, and avoid paying twice for the same digital tools. That logic still holds. But AI has changed the threat landscape. A codebase that once required a skilled human attacker to dissect may now offer a machine-assisted shortcut, especially if models can scan, interpret, and weaponize vulnerabilities at speed.

Key Facts

  • NHS England rules have said software created with public money should be publicly available.
  • Officials now appear to be restricting access because of fears that AI could aid hacking.
  • Concerns reportedly involve AI models such as Mythos and their potential security implications.
  • The policy shift raises tension between transparency, reuse, and cyber defense.

The move also signals a broader debate that extends well beyond one health system. Public institutions increasingly rely on software in critical services, and each decision about disclosure now carries higher stakes. Keeping code closed may reduce immediate exposure, but it can also limit outside scrutiny that sometimes helps catch flaws early. Opening it, meanwhile, may support innovation while giving malicious actors more material to study. Neither path looks simple anymore.

What happens next will matter far beyond NHS England. Policymakers will likely face pressure to redraw open-source rules for the AI era, especially in sectors that hold sensitive data and deliver essential services. The bigger question is no longer whether governments should share code by default, but how they can protect transparency without giving attackers a sharper set of tools.