Causal Security's AI agent found four EPICS Base flaws, one critical, in under four hours

An autonomous AI agent built by the security start-up Causal Security has found four severe vulnerabilities in EPICS Base, the core of the Experimental Physics and Industrial Control System. EPICS is open-source software, originally developed at Los Alamos and Argonne national laboratories, for building distributed control systems that link operators to physical equipment. The Register reports it is used in about 90 major scientific, university and industrial projects, including Argonne's Advanced Photon Source and the control system of the ITER fusion project.

Four bugs, one potentially critical

According to Causal Security co-founder Shubham Raj, the agent, called Cipher, investigated the code, tested it and validated working exploits in 3 hours and 49 minutes. He told The Register the first phase ran without human input, and that a person then gave a single instruction to probe exploitability further in an isolated environment.

The most serious flaw, CVE-2026-114595, is rated 9.8 on CVSS v3.1. It is an integer overflow in how network requests are processed, which lets attacker-supplied data trigger an out-of-bounds write on the heap and could allow remote code execution. The three others are rated high: CVE-2026-114596 (8.2), an improper length check on protocol messages that can corrupt memory and crash the controller; CVE-2026-114597 (7.5), an out-of-bounds read; and CVE-2026-114598 (7.5), a type confusion bug that can cause denial of service and may expose nearby memory. The Mallory threat feed says the issues sit in Channel Access and pvAccess protocol handling and affect EPICS Base 7.0.10 and earlier.

Patch and exposure

The US Cybersecurity and Infrastructure Security Agency (CISA) published advisory ICSA-26-300-01 on 27 October, warning of possible denial of service, memory corruption, information leaks or code execution. The fixes are in EPICS Base 7.0.11, The Register reports. When we checked on 29 October, the release announcements on the epics-controls.org website still listed 7.0.10 as the latest version, so operators should confirm availability through official channels.

Exploitation requires network access to EPICS services on a facility's control network, for instance through poor segmentation. No authentication is needed, and Mallory reports no known exploitation so far. Raj argues that once inside, attacking these services would not require deep operational-technology expertise, though steering a specific physical process would.

Why it matters

The company's speed claims have not been independently measured, but the case adds to evidence that AI agents can audit niche industrial code quickly, for defenders and potentially for attackers.