AI agent Cipher finds four EPICS bugs in under four hours

An autonomous AI agent called Cipher from Causal Security discovered four previously unknown vulnerabilities in the open-source EPICS control software, including a critical 9.8-rated integer overflow (CVE-2026-114595) that could enable remote code execution. Fixes ship in EPICS Base 7.0.11, and CISA issued an advisory.

• Critical CVE-2026-114595 (9.8) is an integer overflow enabling heap write and possible RCE
• Three more flaws rated 8.2, 7.5 and 7.5 cover message length, bounds checks and type confusion
• The agent found and validated all four exploits in 3 hours 49 minutes with minimal human input
• EPICS runs about 90 scientific and industrial facilities, including ITER and Advanced Photon Source