An AI agent called Cipher independently discovered four security holes in the EPICS Base software toolkit in three hours and 49 minutes, according to Causal Security co-founder Shubham Raj. The vulnerabilities include a critical integer overflow bug (CVE-2026-114595) rated 9.8 on the CVSS v3.1 scale, which could lead to remote code execution.
The US Cybersecurity and Infrastructure Security Agency (CISA) issued an advisory Tuesday warning that successful exploitation could allow an attacker to cause denial-of-service, corrupt memory, disclose sensitive information, or execute arbitrary code.
“The initial investigation required no human intervention, followed by one instruction authorizing deeper exploitability testing in a secure environment,” Raj told The Register. He described Cipher as “a fully autonomous super hacker that can reason across the technology stack.”
The other vulnerabilities include an improper message-length validation flaw (CVE-2026-114596, rated 8.2), an insufficient bounds checking bug (CVE-2026-114597, rated 7.5), and a type confusion flaw (CVE-2026-114598, rated 7.5). All four affect EPICS Base, used in about 90 major scientific and industrial projects globally, including Argonne National Laboratory's Advanced Photon Source and ITER's fusion reactor control system.
Exploitation requires network access to vulnerable EPICS services. Raj noted that once an attacker reaches a misconfigured network, conventional exploitation skills are sufficient, and AI systems could help develop exploits without specialized operational technology expertise. Earlier this year, Cipher found critical attack paths in power-grid systems, leading to an October 8 CISA advisory.