An AI Agent Needed Under Four Hours to Find Critical Bugs in Software That Runs Fusion Reactors and Accelerators

The software that runs particle accelerators and fusion experiments has been around for decades. An AI agent that had never seen it found four serious holes in it in three hours and 49 minutes.

The agent is Cipher, built by Causal Security. Its target was EPICS Base, the open source core of the Experimental Physics and Industrial Control System. One of the flaws it found is a 9.8 critical bug that could allow remote code execution.

CISA published an advisory on Tuesday, and the fixes are in EPICS Base 7.0.11. No exploitation in the wild has been reported.

What EPICS controls

Los Alamos and Argonne national laboratories originally developed EPICS. Facilities use it to build and remotely control distributed SCADA systems, which connect operators to physical devices. Around 90 major scientific, university and industrial sites run it, including Argonne's Advanced Photon Source and the control system of ITER's fusion reactor.

Causal co-founder Shubham Raj described what a bad day could look like. "Imagine a particle accelerator in the middle of an expensive experiment," Raj told The Register. "An attacker could potentially crash a controller, interrupt critical measurements or control functions, and force operators to halt the experiment."

Remote code execution would go further, letting an attacker "take control of the affected process, manipulate readings, interfere with control functions, or disrupt the equipment connected to it."

Four bugs, one update

CVE-2026-114595 is the worst, an integer overflow that leads to an attacker-controlled out-of-bounds heap write and potentially code execution. CVE-2026-114596, rated 8.2, comes from improper message-length validation and can cause an out-of-bounds write and crash a controller process.

The two others are rated 7.5. CVE-2026-114597 involves insufficient bounds checking, which causes out-of-bounds reads and crashes. CVE-2026-114598 is a type confusion bug that allows denial of service and possible exposure of adjacent memory.

CISA's summary covers the range: exploitation could let an attacker "cause a denial-of-service condition, corrupt memory, disclose sensitive information, or potentially execute arbitrary code."

The barrier that just moved

There is a real precondition. An attacker has to reach vulnerable EPICS services on the facility's control network, which is possible when networks are poorly segmented or when another system already has access. After that, Raj says, the work gets easy: "Once an attacker is able to find a network, which is either misconfigured or they are able to reach, it's pretty easy to carry out the attacks."

The human contribution was small. Raj says Cipher found all four independently, investigating the unfamiliar system and validating exploits itself. "The initial investigation required no human intervention, followed by one instruction authorizing deeper exploitability testing in a secure environment," Raj said.

Raj sells the product and calls it "a fully autonomous super hacker," so the phrasing deserves some salt. The CVEs and the CISA advisory are harder to wave away. Nor is EPICS its first catch. Earlier this year, Cipher found critical attack paths in power grid systems used across North America and Europe, which prompted a CISA advisory on October 8.

Agents have been moving fast on mainstream targets too. In August, XBOW used agents running a public OpenAI model to build a full Chrome exploit chain in six days, though people there still chose the targets and decided which pieces to join.

Industrial software was supposed to enjoy a different kind of protection, because so few people understood it. That obscurity is wearing thin. Raj said "an attacker doesn't need to understand the physics of a particle accelerator to disrupt the software controlling it," and that attackers may "no longer need years of specialized expertise just to discover these weaknesses."

Defenders' larger fear is an autonomous attack that eventually shuts down power grids or water systems. Nothing like that has happened here. What happened is that control software trusted by around 90 facilities gave up four CVEs in less than four hours.

Some offers on this page may be paid placements or contain affiliate links.