AI ‘hacker’ finds 4 severe bugs in popular industrial control software in under 4 hours

An autonomous AI agent found four previously unknown vulnerabilities in EPICS, software used to monitor and control equipment at major research facilities. One flaw is rated critical and could potentially allow remote code execution, raising concerns about the security of industrial systems that connect computers to physical equipment.

The agent, Cipher, identified and tested the flaws in three hours and 49 minutes, according to Causal Security co-founder Shubham Raj. The bugs affect EPICS Base and include an integer overflow, two memory-bounds errors and a type confusion flaw; together they could enable code execution, crashes or information disclosure. EPICS is used at around 90 scientific, university and industrial projects, including the Advanced Photon Source and ITER, and users are advised to update to version 7.0.11.