On October 27, The Register reported that an AI agent called Cipher, built by Causal Security, found four flaws in EPICS Base, free software used to control particle accelerators and fusion experiments. Causal says Cipher found all four in 3 hours and 49 minutes, a figure that comes from the company itself and has not been independently checked.
The Register says about 90 major projects and facilities use EPICS, including Argonne’s Advanced Photon Source and ITER. The EPICS project list only says “many dozens,” so treat 90 as The Register’s count.
The flaws
Three are in how a controller reads Channel Access messages. The fourth is in how pvAccess decodes data types. The worst, CVE-2026-114595, is rated 9.8 out of 10 by CISA.
Here is how that one works. A request carries an element count. The software multiplies it by the size of each element to decide how much memory to set aside. If the count is large enough, the multiplication wraps around to a small number. The software reserves too little memory, then writes the full request into it and runs past the end. The other three are rated 8.2, 7.5 and 7.5 and can crash a controller or read memory they should not. All four are fixed in EPICS Base 7.0.11, released October 27. Crypto Briefing reports that CISA knows of no public exploitation.
How Cipher worked
Causal says Cipher built the affected code in a sandbox and traced each length, count and type to the point where it sizes memory. That is the same spot where the overflow happens. It then reproduced all four crashes under a memory-error checker, each against a control run that rules out normal behavior. SecurityWeek adds that Cipher started with no knowledge of EPICS and was not given attack techniques for scientific control systems.
A reproduced crash is much harder to dismiss than a report, so this is solid evidence the bugs are real.
What the 3:49 does and doesn’t tell us
The timing is harder to judge. Causal sells the tool, and no outside group has verified the number. Causal hasn’t said which model Cipher used, how much computing it needed, or how many attempts it took, so the cost per bug can’t be compared. We also don’t know who picked EPICS, and a human approved the deeper testing. Nobody has published how long a skilled auditor or a fuzzer would need on the same code, so “fast” has nothing to be measured against. Causal also says Cipher did not demonstrate remote code execution, so the 9.8 score reflects what this kind of bug could allow, not what was shown.
The timeline shows where the time went. Causal says it reported the bugs on June 9. The fixes were merged on July 23 and August 10. Finding the bugs took hours. Getting them fixed took weeks, and people did that part.
Old bugs, new finder
These are familiar problems: integer overflows, missing bounds checks and a type mix-up in C and C++ code. Fuzzers and static analysis tools have gone after this kind of bug for years. SecurityWeek says the flaws are between about 14.5 and 31.5 years old. The maintainers’ fix also mentions a later public report covering some of the same issues, so someone else was close. That is our reading, not a finding, but it suggests the bugs were findable and that few people were looking at this code.
What to do
An attacker would first need to reach the control network, so keeping it separate lowers the risk. A crash could still halt an experiment and waste costly work. If you run EPICS, update to Base 7.0.11. Test older clients first, because Causal says the stricter message checks may affect them.
