An autonomous AI agent discovered four vulnerabilities in the decades-old, widely used EPICS (Experimental Physics and Industrial Control System) open source software toolkit, including a critical flaw that could allow remote attackers to execute code on systems used to control particle accelerators and fusion experiments. The bugs include a critical, 9. 8-rated under CVSS v3. 1 integer overflow vulnerability ( CVE-2026-114595 ), leading to an attacker-controlled out-of-bounds heap write and potentially remote code execution; an 8. 2-rated, high-severity, improper message-length validation flaw ( CVE-2026-114596 ), causing an out-of-bounds memory write and controller-process crash; a 7. 5-rated, high-severity insufficient bounds checking bug ( CVE-2026-114597 ) that allows out-of-bounds memory reads and process crashes; and a 7. 5-rated, high-severity type confusion flaw ( CVE-2026-114598 ) that can lead to denial of service and could expose adjacent memory contents. All four affect EPICS Base, which is used to operate some of the world’s largest scientific research projects and facilities, and organizations should update to version 7. 0. 11, which includes the fixes. “Successful exploitation of these vulnerabilities could allow an attacker to cause a denial-of-service condition, corrupt memory, disclose sensitive information, or potentially execute arbitrary code,” the US Cybersecurity and Infrastructure Security Agency (CISA) warned in a Tuesday advisory. An AI agent called Cipher independently found all four previously unknown security holes – investigating and testing the unfamiliar EPICS system, and validating the four exploits – in three hours and 49 minutes, Causal Security co-founder Shubham Raj told The Register . “The initial investigation required no human intervention, followed by one instruction authorizing deeper exploitability testing in a secure environment,” Raj said. Earlier this year, Causal Security’s Cipher, which Raj described as “a fully autonomous super hacker that can reason across the technology stack,” found multiple critical attack paths in power-grid systems used across North America and Europe, prompting an October 8 security advisory from CISA. EPICS, originally developed by Los Alamos National Laboratory and Argonne National Laboratory, is used to build and remotely control distributed Supervisory Control and Data Acquisition (SCADA) systems, connecting operators to physical devices…