A fellow passenger took a photo of the well-worn red box - with the key in the lock - while the PM was in another part of the train.
"It was just sitting there. I could probably have run off with it if I'd wanted to," the passenger said.
But Downing Street insisted the box was "not left unattended" as the premier's security detail "was there at all times".
In 1999, Labour minister Peter Kilfoyle issued guidance that red boxes should be "effectively disguised" if it was necessary to carry them on public transport.
Former deputy prime minister John Prescott said: "I'm staggered that a prime minister should be so slack about looking after Government secrets.
"The box could have contained detailed confidential intelligence about Syria. I never let mine out of my sight. Talk about Inter Twitty. The guy needs to get a grip."
The snap was taken on Saturday as Mr Cameron - fresh from the fraught G20 summit in Russia - took the train from King's Cross, London, to York to attend his sister-in-law's wedding.