From the side that AI is good comes an autonomous AI research system uncovering four long-standing vulnerabilities in EPICS Base. Which you can find more about here: https://www.scworld.com/brief/autonomous-ai-agent-discovers-critical-vulnerabilities-in-epics-software
Roland Lindsey, Chief Product Security Engineer, Finite State:
“From what we have seen in our practice, the vast majority of firmware and software systems have undetected RCEs, and detection is now trivial.
“If you haven’t seen them in your systems, you haven’t looked.”
Jacob Krell, Sr. Director: Secure AI Solutions & Cybersecurity, Suzu Labs: l
“The four EPICS (Experimental Physics and Industrial Control System) flaws existed for between 14.5 and 31.5 years before anything surfaced them. Cipher, Causal Security’s autonomous research system, needed three hours and forty-nine minutes. The backlog traces back to the engineering priorities. Software built to hold a particle beam stable for decades between rebuilds prizes determinism and uptime, which favors manual memory management in C and C++, fixed wire formats, and Channel Access, a control protocol whose access rules rest on client and host identity rather than cryptographic authentication. All four flaws are reachable without authentication. Facilities freeze installs for years at a time because rebuilding a control system means stopping experiments, so vulnerable versions stay deployed long after fixes exist. High availability engineering built that exposure, and autonomous agents are now harvesting it.
“For offensive security testing, the economics changed. Auditing unfamiliar software used to cost a researcher months for a handful of CVE (Common Vulnerabilities and Exposures) entries, so attackers and defenders both worked the famous products. Cipher started with no knowledge of EPICS and demonstrated an attacker-controlled heap-buffer-overflow write in an afternoon, which shrinks the effort side of that calculation for at least the class of codebase it resembles. Remediation capacity is the scarce resource now. EPICS has no vendor patch Tuesday, and the fix is EPICS Base 7.0.11 or a supported backport. I’d restrict Input/Output Controller (IOC) protocol access to authorized control-network hosts rather than trusting port lists, since Channel Access and pvAccess also use UDP discovery traffic on 5064 and 5076 and can be configured on other TCP ports. Four hours to find the flaw only matters if you can deploy the fix without shutting down the beam.”
I do admit that AI can be used for good. But only if the proper precautions are taken. Such as sandboxing it. It’s a #fail if that’s not the case.
Related
This entry was posted on October 29, 2026 at 8:37 am and is filed under Commentary with tags AI. You can follow any responses to this entry through the RSS 2.0 feed.
You can leave a response, or trackback from your own site.
AI uncovers decades-old vulnerabilities in EPICS software
From the side that AI is good comes an autonomous AI research system uncovering four long-standing vulnerabilities in EPICS Base. Which you can find more about here: https://www.scworld.com/brief/autonomous-ai-agent-discovers-critical-vulnerabilities-in-epics-software
Roland Lindsey, Chief Product Security Engineer, Finite State:
“From what we have seen in our practice, the vast majority of firmware and software systems have undetected RCEs, and detection is now trivial.
“If you haven’t seen them in your systems, you haven’t looked.”
Jacob Krell, Sr. Director: Secure AI Solutions & Cybersecurity, Suzu Labs: l
“The four EPICS (Experimental Physics and Industrial Control System) flaws existed for between 14.5 and 31.5 years before anything surfaced them. Cipher, Causal Security’s autonomous research system, needed three hours and forty-nine minutes. The backlog traces back to the engineering priorities. Software built to hold a particle beam stable for decades between rebuilds prizes determinism and uptime, which favors manual memory management in C and C++, fixed wire formats, and Channel Access, a control protocol whose access rules rest on client and host identity rather than cryptographic authentication. All four flaws are reachable without authentication. Facilities freeze installs for years at a time because rebuilding a control system means stopping experiments, so vulnerable versions stay deployed long after fixes exist. High availability engineering built that exposure, and autonomous agents are now harvesting it.
“For offensive security testing, the economics changed. Auditing unfamiliar software used to cost a researcher months for a handful of CVE (Common Vulnerabilities and Exposures) entries, so attackers and defenders both worked the famous products. Cipher started with no knowledge of EPICS and demonstrated an attacker-controlled heap-buffer-overflow write in an afternoon, which shrinks the effort side of that calculation for at least the class of codebase it resembles. Remediation capacity is the scarce resource now. EPICS has no vendor patch Tuesday, and the fix is EPICS Base 7.0.11 or a supported backport. I’d restrict Input/Output Controller (IOC) protocol access to authorized control-network hosts rather than trusting port lists, since Channel Access and pvAccess also use UDP discovery traffic on 5064 and 5076 and can be configured on other TCP ports. Four hours to find the flaw only matters if you can deploy the fix without shutting down the beam.”
I do admit that AI can be used for good. But only if the proper precautions are taken. Such as sandboxing it. It’s a #fail if that’s not the case.
Share this:
Like this:
Related
This entry was posted on October 29, 2026 at 8:37 am and is filed under Commentary with tags AI. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.