An AI agent found four EPICS bugs in under four hours
This week CISA published advisory ICSA-26-300-01 for four previously unknown memory-safety vulnerabilities in EPICS Base, the open-source toolkit behind particle accelerators and fusion experiments. An autonomous agent called Cipher found and validated all four in an unfamiliar codebase in 3 hours and 49 minutes. The fixes ship in EPICS Base 7.0.11.
What is EPICS and where does it run?#
EPICS stands for Experimental Physics and Industrial Control System. Los Alamos National Laboratory and Argonne National Laboratory started it decades ago, and big-science facilities use it to build distributed control systems, connecting operators to physical devices. An Input/Output Controller exposes process variables and control functions on the network, and operator software reaches them through two protocols, Channel Access and pvAccess. The project list at epics-controls.org names many dozens of projects across disciplines, sizes and continents, including Argonne's Advanced Photon Source and the control system of the ITER fusion reactor.
Causal Security, the company behind Cipher, states the scope in the opening of its write-up: routine monitoring and control depends on network services parsing messages from other machines, so the correctness of those parsers is part of a facility's security boundary. Accelerators have dedicated protection systems. The parsers that carry everyday commands and measurements sit outside them.
How does an agent find four unknown bugs in 3 hours and 49 minutes?#
Cipher is Causal Security's autonomous security system, and co-founder Shubham Raj described it to The Register as "a fully autonomous super hacker that can reason across the technology stack". On EPICS it worked from a codebase it had never seen. It traced every count, length and decoded type arriving over the wire to the point where that value sizes an allocation, indexes memory or gets cast. It built the affected components in an isolated sandbox, reproduced all four bugs itself under AddressSanitizer or a debugger, and ran each reproduction against a negative control that separates the fault from ordinary protocol behavior. Raj: "The initial investigation required no human intervention, followed by one instruction authorizing deeper exploitability testing in a secure environment."
The disclosure timeline shows the agent did its part months ago. Causal Security reported the findings to the EPICS security channel on 9 June, the Channel Access fixes merged on 23 July, the pvAccess fix followed on 10 August, and the 7.0.11 release and the CISA advisory landed together on 27 October. For this agent it is the second CISA advisory in a month. On 8 October CISA published ICSA-26-281-02 for five vulnerabilities in openPDC and openHistorian, Grid Protection Alliance software used in power grids, and The Register attributes those findings to Cipher as well.
Four memory-safety bugs in one protocol stack#
Three of the four live in server-side Channel Access message handling, and the critical one is CVE-2026-114595, rated 9.8 under CVSS v3.1. A Channel Access request carries a data type and an element count. The server checks the type, and the count goes unbounded into a multiplication by the element size. That 32-bit calculation can wrap, the allocation comes out smaller than the conversion that follows needs, and attacker-influenced bytes land past the end of the undersized heap buffer. CISA rates the issue critical and names potential remote code execution. Cipher demonstrated the write and the crash, and stopped short of building an RCE exploit.
The other three need less setup. CVE-2026-114596 (8.2) sends an extended-header length that wraps the server's message-size calculation, so an oversized value passes the check that exists to reject it, and a later step reuses the original length as the offset for a single out-of-bounds byte. CVE-2026-114597 (7.5) lets a write request declare more elements than the payload carries, and the server converts data past the end of its receive buffer. The last one, CVE-2026-114598 (7.5), sits in the pvAccess deserializer and is reached during connection validation, before authentication completes: a decoded field gets cast to the expected element type without checking that it has that type, and code reads through the wrong memory layout. CISA's summary covers the range: "Successful exploitation of these vulnerabilities could allow an attacker to cause a denial-of-service condition, corrupt memory, disclose sensitive information, or potentially execute arbitrary code." Every release up to and including 7.0.10 carries all four.
What does an attacker need to reach them?#
Reachability does most of the work. Channel Access listens on TCP 5064 and pvAccess on TCP 5075, with discovery traffic on UDP beside them, and EPICS deployments are supposed to sit behind a segmented control-network boundary. Exploiting these bugs in a real facility therefore starts with reaching those services, through weak segmentation or through another compromised system with a path into the control network. Raj told The Register: "Once an attacker is able to find a network, which is either misconfigured or they are able to reach, it's pretty easy to carry out the attacks." Nothing in Cipher's test configuration required a privileged account.
Credentials and physics rank low among the barriers. EPICS access-security rules and pvAccess authentication govern what a client may read or write once connected, and they do not make a malformed message safe to parse. Raj: "Someone with conventional exploitation skills could investigate them, and increasingly capable AI systems could help develop exploits without requiring specialized OT expertise." He added: "But an attacker doesn't need to understand the physics of a particle accelerator to disrupt the software controlling it. Crashing critical processes or interrupting monitoring and control can already have serious operational consequences." His picture of the damage, again to The Register: a controller crash in the middle of an expensive experiment can force operators to halt it, which means lost experimental work, downtime and expensive recovery. Steering a specific physical process takes deeper knowledge. Crashing the software that measures and commands it does not.
The fix and what surrounds it#
Update to 7.0.11, or take a vendor backport where a facility consumes EPICS inside a supported package. The inventory matters because deployment runs through internally maintained builds as well as vendor-provided controllers and beamline packages, so version lists need checking for both. One rollout wrinkle is documented: the 7.0.11 release notes warn that the stricter Channel Access message validation can affect interoperability with older CA clients, and in a control system that means testing legacy clients before the production rollout.
Network shape remains the control that outlasts any single patch. CISA's standing advice for control systems is to isolate them from business networks and to secure the remote access that cannot be avoided, and the smallest auditable version of that is a reviewed site-to-site tunnel. The WireGuard walkthrough on this site fits one in about twenty lines of config per peer. The timing also connects to something the October PHP release showed from the receiving end: the PHP security team worked through a report flood that came with AI-assisted vulnerability research. Agents have helped validate reports for a while now. This one found the bugs, validated them and reported them through coordinated disclosure. The same week supplied the other half of the agentic-security story: a planted AGENTS.md file hijacked coding agents from a Downloads folder, and no patch exists for that one.
For facilities the remaining work is the operator-side half: inventory EPICS Base versions including vendor-embedded builds, and check the network paths into the control segments. CISA has received no report of public exploitation targeting these four vulnerabilities so far, and the fixes have been in 7.0.11 since 27 October.