An autonomous AI agent called Cipher, from Causal Security, found four previously unknown flaws in EPICS Base, the decades-old open-source toolkit used to control particle accelerators, fusion experiments and other big science. It took 3 hours and 49 minutes, with no human help on the first pass and one instruction to go deeper.
The bugs
- CVE-2026-114595 (CVSS 9.8): an integer overflow leading to an out-of-bounds heap write and possible remote code execution.
- CVE-2026-114596 (8.2): bad message-length validation, an out-of-bounds write and a crash.
- CVE-2026-114597 (7.5): out-of-bounds reads and crashes.
- CVE-2026-114598 (7.5): type confusion causing denial of service and possible memory exposure.
CISA issued an advisory Tuesday. The fix is EPICS Base 7.0.11.
Checklist
- If you run EPICS, update to 7.0.11.
- Keep control systems off the internet and behind segmented networks.
- Assume “obscure” no longer means safe. AI agents read old protocols just fine.
God Bless, and Needs Garlic!
