AI agent discovers four critical vulnerabilities in EPICS software

EPICS: EPICS is the Experimental Physics and Industrial Control System, an open source software toolkit originally developed by Los Alamos National Laboratory and Argonne National Laboratory for building and remotely controlling distributed SCADA systems that connect operators to physical devices in scientific and industrial settings. It powers control systems at major facilities worldwide, including particle accelerators and fusion experiments such as ITER. In this news, the decades-old toolkit was the target of an autonomous AI agent that uncovered multiple previously unknown vulnerabilities affecting its Base version. Shubham Raj: Shubham Raj is the co-founder of Causal Security and has been directly involved in demonstrating the capabilities of the company's AI agent Cipher in real-world vulnerability discovery. He provided detailed commentary on the EPICS findings, including the potential operational impacts on scientific facilities and the broader implications for AI-driven security testing. In this news, Raj explained the exploitation scenarios and the minimal prerequisites needed for an attacker to leverage the discovered flaws. CVE-2026-114595: CVE-2026-114595 is the critical integer overflow vulnerability in EPICS Base that enables an attacker-controlled out-of-bounds heap write with potential for remote code execution on systems controlling particle accelerators and fusion experiments. It was one of four flaws independently discovered and validated by the AI agent Cipher. The vulnerability was highlighted by Causal Security for its ability to allow network data to corrupt memory in ways that could disrupt critical control functions. CVE-2026-114596: CVE-2026-114596 is a high-severity improper message-length validation flaw in EPICS Base that causes an out-of-bounds memory write and can crash the controller process. It was identified and tested autonomously by the AI agent Cipher alongside three other vulnerabilities. The flaw contributes to risks of denial-of-service conditions on industrial control systems used in major research facilities. CVE-2026-114597: CVE-2026-114597 is a high-severity insufficient bounds checking bug in EPICS Base that permits out-of-bounds memory reads and can lead to process crashes. Discovered by the autonomous AI agent Cipher, it affects the widely deployed toolkit responsible for operating scientific infrastructure. The vulnerability underscores how AI agents can efficiently uncover memory safety issues in long-standing operational technology software. CVE-2026-114598: CVE-2026-114598 is a high-severity type confusion flaw in EPICS Base that can result in denial of service and potential exposure of adjacent memory contents. It was part of the set of four previously unknown vulnerabilities found and validated by Causal Security's AI agent Cipher in under four hours. The flaw adds to concerns about AI accelerating the discovery of weaknesses in systems that historically relied on obscurity for protection. Causal Security: Causal Security is the company behind the autonomous AI agent known as Cipher, described as a fully autonomous system capable of reasoning across technology stacks to discover and validate security vulnerabilities. The firm previously used Cipher to identify critical attack paths in North American and European power-grid systems. In this news, Causal Security co-founder Shubham Raj detailed how Cipher independently discovered and validated four severe flaws in EPICS in under four hours with minimal human input. Industry Context: EPICS software is deployed across approximately 90 major scientific, university, and industrial projects globally, including control systems for particle accelerators and fusion reactors where network segmentation is a key defense requirement. Regulatory Response: The US Cybersecurity and Infrastructure Security Agency issued an advisory highlighting the risks of denial-of-service, memory corruption, information disclosure, and potential arbitrary code execution from the EPICS vulnerabilities. Vulnerability Discovery: An autonomous AI agent successfully investigated an unfamiliar industrial control system and validated multiple exploits with only one authorizing instruction from a human operator.