Cameron left the "Prime Minister"-embossed briefcase with the key still in it and no apparent security in the car on a passenger train, The Daily Mirror reported Monday.
One passenger told the Mirror he took a picture of the red case and no one intervened.
The prime minister's office said the so-called red box was watched at all times.
The passenger told the Mirror he spotted Cameron, who was going to a wedding near York, walking from a table in the dining car.
The man said he saw Cameron's briefcase "on a table all alone."
"I could have quite easily ... damaged it or scratched it or run off with it. And above all I couldn't believe the key was in the lock," the unidentified man said. "It was just sitting there. I could probably have run off with it if I'd wanted to. But instead I took a photo."
Cameron, who once left his 8-year-old daughter at a pub following lunch, was criticized by other politicos for leaving the official case behind.
Former government official Kevan Jones, a Labor Party lawmaker, said, "I was never allowed to take my red box on public transport. There were very clear rules. It's astonishing, quite frankly, that he would just get up and walk off down the aisle. There could be any number of state secrets in that box."
The red box's contents were not known.