Webmasters LDN
Contact
← Blogs

October 28, 2026 · Blogs

AI found four severe bugs in under four hours: what it means for your software

An autonomous AI agent found four serious flaws in EPICS industrial control software in three hours and 49 minutes. What was found, how defenders are responding and what it means for your own systems.

An autonomous AI agent has found four previously unknown security flaws in EPICS, open-source software used to control particle accelerators and fusion experiments, in three hours and 49 minutes. The case, reported by The Register on 27 October 2026, is the clearest sign yet that AI is changing how quickly vulnerabilities are found, by defenders and attackers alike.

What was found

EPICS (Experimental Physics and Industrial Control System) was originally developed by Los Alamos and Argonne National Laboratories. It connects operators to physical equipment in around 90 major scientific, university and industrial facilities, including Argonne's Advanced Photon Source and ITER's fusion reactor control system.

The four flaws, all in EPICS Base, are:

  • CVE-2026-114595, critical, CVSS 9.8: an integer overflow leading to an attacker-controlled out-of-bounds heap write and potential remote code execution.
  • CVE-2026-114596, high, 8.2: improper message-length validation causing an out-of-bounds write and a controller crash.
  • CVE-2026-114597, high, 7.5: insufficient bounds checking allowing out-of-bounds reads and crashes.
  • CVE-2026-114598, high, 7.5: type confusion that can cause denial of service and may expose adjacent memory.

The fixes are in EPICS Base version 7.0.11. The US Cybersecurity and Infrastructure Security Agency (CISA) issued an advisory on 27 October warning that exploitation could allow an attacker to cause a denial of service, corrupt memory, disclose sensitive information or potentially execute arbitrary code.

How the AI did it

The agent, called Cipher, is made by Causal Security. Its co-founder Shubham Raj told The Register that the initial investigation needed no human intervention, followed by a single instruction authorising deeper exploitability testing in a secure environment. Earlier this year Cipher found critical attack paths in power-grid systems used across North America and Europe, which led to a CISA advisory on 8 October.

Raj's point is that attackers "may no longer need years of specialised expertise just to discover these weaknesses". Systems that once relied on being obscure now get the same scrutiny as everything else.

Defenders are using the same tools

The industry is racing to put this capability on the defending side:

  • Oracle AI Security Mesh, announced on 27 October, is a managed service that will use OpenAI cybersecurity models to find vulnerabilities, test whether they can be exploited and recommend fixes in the parts of a company's technology that it is authorised to examine.
  • Cohere set up a cyber division this month as part of its deal to buy Prague-based Aisle, whose AI security system, BetaKit reports, claimed to find most of the vulnerabilities in the latest release of curl, the widely used data transfer tool.

What this means for your software

If AI can find flaws in decades-old industrial code in under four hours, it can find them in a typical web application or API. The practical consequences:

  • Patch faster. The gap between a flaw being found and being exploited is shrinking. Apply security updates to frameworks, libraries and servers within days, not months.
  • Know your dependencies. Keep an up-to-date list of the open-source components in every application so you can tell at once whether a new advisory affects you.
  • Segment networks. The EPICS flaws can only be exploited by someone who can reach the vulnerable services. Keep admin panels, databases and internal tools off the public internet and away from each other.
  • Test your own code the same way. Commission regular security testing, including AI-assisted testing, so you find weaknesses before someone else does.
  • Authorise carefully. AI security tools act on what they are allowed to reach. Agree the scope in writing, as Oracle's service and Causal Security's controlled testing both do.

Webmasters LDN builds, maintains and secures web platforms and apps for UK businesses, including dependency monitoring and regular security reviews. If you are not sure when your systems were last tested, we can help.

This article summarises news reports and advisories published up to 28 October 2026.

Sources