al-ice.ai

Three Hours, Forty-Nine Minutes, Four Flaws: An AI Agent Audits the Software Steering Particle Accelerators

Agent & Supply Chain Security by al-ice.ai Editorial

An autonomous AI agent needed less than one working morning to find four previously unknown vulnerabilities in EPICS Base, the open-source toolkit that helps run particle accelerators and fusion experiments. CISA published advisory ICSA-26-300-01 on 27 October 2026 covering CVE-2026-114595 through CVE-2026-114598, with the worst — an integer overflow in network request processing — rated 9.8 critical and carrying potential for remote code execution. Per reporting on the discovery, the research outfit Cipher found all four flaws in 3 hours and 49 minutes, and the disclosure was coordinated: a fixed EPICS Base 7.0.11 shipped the same day as the advisory.

The four flaws read like a greatest-hits of C memory unsafety, all reachable over the network with no privileges and no user interaction. CVE-2026-114595 is the critical one (CWE-190 integer overflow, CVSS 3.1 9.8 / 4.0 9.3): attacker-supplied data gets memory allocated at the wrong size, opening memory corruption, denial of service, or remote code execution. CVE-2026-114596 is improper message-length validation during protocol parsing that overflows into an out-of-bounds write (8.2 high / 8.8). CVE-2026-114597 is insufficient validation of element and length values that reads past an allocated buffer — a denial-of-service risk that can also expose adjacent memory contents. CVE-2026-114598 is a type-confusion flaw (CWE-843, 7.5 high / 8.7). Every EPICS Base release at or below 7.0.10 is affected; CISA places the impacted systems in the Critical Manufacturing sector with worldwide deployment, and credits Shubham Raj of Cipher / Causal Security with reporting the flaws. Fixes landed via epics-base pull requests 934 and 937 plus pvDataCPP pull request 109.

Why defenders should take this seriously — and where to discount it

The serious part is the clock. A coordinated, patched disclosure of four memory-safety flaws in decades-old control-system code — found by an agent, not a human audit team, in under four hours — is the clearest field data yet that AI-driven vulnerability discovery has reached industrial control software, not just web apps and npm packages. Defenders have seen the shape before: AI agents going from session hijack to root in seconds against Zammad zero-days, and the openPDC case where CISA’s ICS advisory patched the grid only in nightly builds with no release to install. The EPICS case is the well-handled version of that story: same-day patch, clear affected-version boundary, no exploitation reported. The other serious part is exposure arithmetic: control-system devices that were never meant to face the internet increasingly do, and every one of these four CVEs is network-reachable with zero authentication. CISA’s standard guidance applies with unusual force here — keep control systems off the internet, behind firewalls and isolated from business networks, with VPNs (patched ones) for remote access.

The discount is that speed of discovery is not speed of exploitation. These are classic memory-corruption primitives in a niche protocol stack; turning the 9.8 integer overflow into reliable remote code execution on a specific accelerator control host is skilled work the agent did not demonstrate, and CISA states it has received no reports of public exploitation. The “under four hours” figure also describes a prepared agent against a known-open-source target, not a cold start against an unknown plant network. Treat the result as a preview of audit economics — machine-speed first-pass auditing of critical open-source infrastructure — rather than evidence that every ICS deployment is one agent-run from compromise. The immediate action is unglamorous and specific: update to EPICS Base 7.0.11, and use the disclosure window to verify your control hosts are not reachable from networks they were never supposed to touch.

What it means for builders and defenders

  • Patch EPICS Base to 7.0.11 now. All releases at or below 7.0.10 are affected by at least one network-reachable flaw, including a 9.8-critical RCE candidate. The fix is released and referenced directly from the CISA advisory — this is the rare ICS disclosure with no “no release available” caveat.
  • Audit your control-network boundaries, not just your versions. All four CVEs need only network access with no privileges. Inventory which EPICS-speaking hosts are reachable from business networks or the internet, and treat any exposure as the vulnerability, regardless of patch state.
  • Budget for machine-speed auditing of your own dependencies. If an agent can find four flaws in a morning in code your sector depends on, assume attackers run the same loop. Prioritise memory-unsafe, network-facing open-source components in your stack for review — human or machine — before someone else’s agent does it for you.
  • Watch the disclosure, not just the patch. CISA reports no public exploitation as of the advisory date. Track CISA’s KEV catalogue and follow-on reporting — the PHP2Shell timeline showed how fast “no confirmed exploitation” can age — and have an isolation plan ready if that status changes.

Our verification was read-only. The advisory facts — ICSA-26-300-01 dated 27 October 2026, CVE-2026-114595 through CVE-2026-114598, EPICS Base ≤7.0.10 affected with 7.0.11 as the fix, the 9.8/9.3, 8.2/8.8 and 7.5/8.7 CVSS pairs, the CWE-190 and CWE-843 classifications, the epics-base 934/937 and pvDataCPP 109 fix references, the Critical Manufacturing designation, the Shubham Raj of Cipher / Causal Security credit, and the no-known-exploitation statement — were read first-hand from the full CISA advisory text. The discovery narrative — Cipher’s autonomous AI agent, four previously unknown flaws, 3 hours 49 minutes / under four hours — comes from The Register’s reporting as carried in full by two agreeing secondaries (Crypto Briefing and Mezha, both read first-hand); The Register’s own page was bot-walled and is cited with that attribution preserved. No EPICS code was obtained or built, no control system was contacted, no exploit was developed or run, and no researcher or vendor was contacted; all interpretation above is ours. Brave Search was used for discovery only.

Sources: