AI Agent Uncovers Four Serious Flaws in Industrial Control Software in Under Four Hours

An autonomous AI agent has found four previously unknown security flaws in EPICS (Experimental Physics and Industrial Control System), a decades-old open source toolkit used to operate some of the world's largest scientific research projects, including particle accelerators and fusion experiments. According to The Register, the agent, called Cipher and built by Causal Security, found and validated all four issues in three hours and 49 minutes.

One flaw is rated critical (9.8 under CVSS v3.1) and could let a remote attacker run code on affected systems. The other three are rated high severity (8.2, 7.5 and 7.5). They can cause memory errors, crashes of controller processes, denial of service, and in some cases exposure of adjacent memory contents. All four affect EPICS Base. The US Cybersecurity and Infrastructure Security Agency (CISA) issued an advisory warning that exploitation could allow denial of service, memory corruption, information disclosure or potentially arbitrary code execution. Fixes are included in EPICS Base version 7.0.11.

Causal Security co-founder Shubham Raj said the initial investigation needed no human intervention, followed by one instruction authorising deeper exploitability testing in a secure environment. Earlier this year, Cipher also found multiple critical attack paths in power-grid systems used across North America and Europe, which led to a CISA advisory on October 8.