Causal's Cipher Agent Finds Four EPICS Flaws, One a 9.8 RCE

An autonomous AI agent called Cipher, built by Causal Security, found four previously unknown vulnerabilities in EPICS Base, the open-source control toolkit behind particle accelerators and fusion reactor control systems, in three hours and 49 minutes, The Register reported. The bugs include a CVSS 9.8 integer overflow (CVE-2026-114595) that enables remote code execution, plus three high-severity flaws rated 8.2, 7.5 and 7.5.

The agent ran the search largely on its own. "The initial investigation required no human intervention, followed by one instruction authorizing deeper exploitability testing in a secure environment," Causal Security's Shubham Raj told the publication.

EPICS, originally developed by Los Alamos National Laboratory and Argonne National Laboratory, is used in around 90 major scientific, university and industrial projects globally, including Argonne's Advanced Photon Source and ITER's fusion reactor control system. Maintainers have shipped fixes in version 7.0.11.

Raj described the operational stakes directly: "EPICS controllers sit between operators and physical equipment, handling measurements, commands, and control functions. Operationally: Imagine a particle accelerator in the middle of an expensive experiment. An attacker could potentially crash a controller, interrupt critical measurements or control functions, and force operators to halt the experiment." He added that exploitation would not require deep OT knowledge: "Once an attacker is able to find a network, which is either misconfigured or they are able to reach, it's pretty easy to carry out the attacks."

The critical bug, Raj said, "allows attacker-controlled network data to cause an out-of-bounds heap memory write, with potential for remote code execution." The disclosure lands the same week as Anthropic's Frontier Red Team claim that an unreleased Claude chained flaws into working browser and OS exploits, one of several AI-and-cybersecurity stories we're tracking this cycle.