In short
- Causal Security's AI agent found four previously unknown flaws in EPICS, software that controls scientific and industrial facilities.
- The worst flaw scores 9.8 out of 10. The fix is in version 7.0.11.
- CISA reports no known exploitation in attacks.
In short: on 27 October 2026 the US agency CISA published a warning about four flaws in EPICS, open-source software that controls scientific facilities. Shubham Raj of Causal Security reported them, and according to The Register they were found by an AI agent called Cipher.
What was found
- Four flaws, all in EPICS Base version 7.0.10 and earlier.
- The worst has a CVSS score of 9.8 (critical): a memory-size calculation error that can corrupt memory and potentially run foreign code.
- The other three score 8.2, 7.5 and 7.5: mainly knocking a service offline and possibly reading neighbouring memory.
- According to The Register, the agent found and confirmed all four in 3 hours and 49 minutes, with the first investigation done without a human. That timing comes from the company’s co-founder, not from an independent audit.
What to do
- Update EPICS Base to version 7.0.11.
- Keep control networks off the internet and behind a firewall that separates them from the office network.
- Use a current VPN for remote access.
CISA says it knows of no public exploitation of these flaws. An attack requires access to a network where the vulnerable services run.
How to read this
The timing and the credit to the agent come from a company that sells such a tool, so I treat them as the vendor’s claim. The fix and the severity scores, however, come from the official advisory. I cover protecting code and agents in the AI code security hub.