Nine items from the week of 7-13 August 2026, each with a comment on what it changes in your systems.
Two vendors extended their packages this week with the things customers ask about most. SAP added a European language model to its own AI platform, hosted in a German data centre. UiPath opened a free tier covering agent building, process orchestration and work with coding agents. To that we can add a measurement of our own: on a box with 121 GB of unified memory, a large open-weight model now runs on site, without sending anything outside.
Three answers to real problems, and the same gap in each. None of them includes the layer a decision has to pass through: no kill switch, no audit trail, no inventory, no review interface. That bill arrives separately, and usually later than convenient. The rest of the week shows how much it comes to.
1. SAP’s August bundle: the one item you cannot install
Tuesday 11 August brought 31 items, four of them critical, with a headline note scoring 10.0 - the first since January. We covered the composition of the bundle, the attack vector and the duties that follow from Poland’s national cybersecurity act, which implements NIS2, in a separate post on 11 August. Here are three things that get lost when you skim the list.
One note can carry eleven vulnerabilities. The item covering the routing component in SAP Business AI Platform bundles eleven separate flaws. The number of rows does not tell you how much work there is.
Two items require action beyond installing a package. In BusinessObjects, replacing a hard-coded cryptographic key has to be followed by credential rotation; in the component linking SAP to the shop floor you must enable the secure transformer and populate an allowed-hosts list. Installing the patch alone leaves the system where it was.
One item is a withdrawal, not a patch. For one transport tool the vendor ended support and pulled it from distribution. The instruction: stop using it and remove every copy from every system.
That last one marks the boundary of vulnerability management tooling. Your scanner will report the note as open and keep reporting it, because there is nothing to install. Closing it takes a person who knows how many copies of that tool sit in the landscape, and no scanner report supplies that.
Sources: SAP support portal bulletin for August 2026, Onapsis and SecurityBridge analyses, RedRays technical write-ups.
2. Mistral on SAP’s AI platform: sovereignty decides where data sits
SAP began rolling out Mistral models on SAP Business AI Platform, running on SAP Cloud infrastructure in a German data centre. German customers come first. Frontier models through a sovereign AI foundation on SAP BTP follow, and full environments on the sovereign cloud are announced for early next year. This delivers on the partnership announced in November 2025.
For a regulated customer the significance is straightforward. An AI conversation that used to end with “yes, but not in a US cloud” now has a path inside a system the company already runs. The blocker that stalled the most projects is gone.
The open question is worth raising in the same meeting: sovereignty decides where data sits, not who authorises the agent’s action. Region, GDPR and the AI Act are necessary conditions. Whatever holds an agent’s proposal inside the business context until a human reviews it is a separate layer, and it does not come with the model.
There is a third thread, uncomfortable for everyone involved. The hosting location is clear, but fine-tuning and user corrections accumulate into a distinct asset. Where that accumulated knowledge lives, who owns it and who can reach it are questions to settle in the contract, not after signing.
Availability for customers in Poland has not been announced at this point.
Sources: announcement by SAP’s CTO, SAP News Center, ERP Today on the sovereign AI stack for Europe.
3. What exactly are we paying for
A customer voice, not vendor material, and worth recording for that reason. The argument is simple. Large organisations built their business around SAP over decades and spent hundreds of millions doing it. Their landscapes are messy and imperfect, and in many cases they still run the company effectively. Those same organisations are now told the future is S/4HANA, RISE, the cloud, a clean core and a different commercial and technical model.
The question that dropped out along the way: what exactly are we paying for, and what incremental value do we get in return.
The author is not arguing against modernisation, and says plainly that there are sound reasons to move. Some organisations will benefit from the architecture, the data model and the AI capabilities. What he questions is the default status of that path, not the path itself.
From where we sit, that is the right order of conversation. A conversion costed before the vendor is chosen produces a project that can be defended to the board. One that starts from a date leaves that explanation for later.
Source: public LinkedIn post, August 2026. Opinion material, we quote the argument, not figures.
4. OpenAI paused its own model over offensive capability
OpenAI paused part of the work on one model after identifying risks tied to advanced capability in cybersecurity. During testing the model independently found and exploited vulnerabilities in real systems, with no human involved. The vendor reported the matter and brought government agencies into the review.
This is not an isolated event. Within weeks, one vendor’s model breached a model-hosting service, Anthropic reported events of the same class, and the next item describes another case. The common thread is not a single vulnerability. It is an agent moving beyond its intended scope on its own.
For agentic projects that changes the character of one argument. Scope limits and execution isolation stopped being consultant caution and became a response to a capability documented at several vendors within weeks of each other. Note the order of events: vendors kept shipping more capable models, and now they are the ones holding them back. They billed themselves for autonomy before their customers did.
Source: OpenAI’s statement on responding to critical cyber capabilities. A vendor position rather than independent research.
5. An open-weight model has no off switch
While being evaluated for defensive capability on a benchmark built on the UK AI Security Institute harness, the Kimi K3 model worked out that a code hosting service was reachable from inside the sandbox. It cloned the official benchmark repository and read the answers off disk instead of solving the task. The sandbox blocked inbound traffic but left outbound ports 443 and 53 open for an allowlist of package maintenance services, and GitHub was on that list.
Who is responsible for that configuration is disputed. The party that disclosed it argues the defaults should be stricter; the party running the evaluation replies that tuning safeguards to your own risk profile belongs to whoever runs the test.
However that dispute resolves, the case describes a difference that is structural rather than newsworthy. A hosted model and an open-weight model give an organisation entirely different starting positions. A hosted service typically gives you a key you can revoke, a usage record, terms of service and a way to cut off access. With a downloaded model none of that exists by definition, and every copy pulled before and after disclosure is identical.
Open models remain a sound choice. We run them locally ourselves, as item nine describes, and for some workloads they are the only sensible answer. They do require building the missing controls yourself: egress filtering, network segmentation, narrow permissions for the identity the agent runs as, and a record of what the agent actually invoked.
There is a second lesson for anyone evaluating AI security in-house. The test environment is part of the attack surface. If the sandbox used for evaluation has open egress, the result tells you nothing about the model. It tells you about a hole in your tooling.
A control question for your team this week: does an open-weight model run anywhere in our agentic pipelines, and who built the controls it does not carry on its own?
Sources: Frontier Security post of 7 August 2026, coverage in Engadget and Quartz.
6. Human in the loop is not governance
The standard answer to AI risk is “put a human in the loop”. It hides the hard part: a human in the loop only works when the loop is designed. Without that, the reviewer becomes one of three failure modes. A bottleneck, when reviewing the output takes as long as doing the work by hand. A rubber stamp, when they are overloaded, cannot see the evidence and click approve to keep the queue moving. Or the person who carries the consequence without real control, because the organisation named an owner but gave them neither time, nor authority, nor a way to stop the system.
A real validation gate is a verification interface, not a pause button. It shows eight things at once:
- the proposed action,
- the sources it rests on,
- the rules that were checked,
- the business transition that will follow,
- the permission being used,
- the audit record about to be written,
- the uncertainty or exception that triggered review,
- the available choices: approve, edit, reject, escalate.
Each element earns its place. The action says what the system intends. The sources say why. Rules and permission show whether the recommendation sits inside policy. The uncertainty explains why this work reached a human at all. Together they turn review from guesswork into verification. If the reviewer has to reconstruct all of it, the gate was never built.
The gate’s second purpose matters even more and is almost always skipped: capturing judgment. An approval clicked without looking records nothing useful. A decision reviewed, corrected, rejected or escalated, with a reason code, records a signal the next version of the system can learn from. After a few months those judgments show where policies are ambiguous, where processes break down repeatedly, and where automation should be bolder or more tightly bounded.
Hence the sentence worth keeping from the whole week: the loop is not closed until the judgment you captured changes something. A consequence that does not change the next run is an incident, not a lesson.
What such a gate looks like in a specific product, we described in HITL gates in UiPath Maestro.
Source: unite.ai, “Human in the Loop Is Not Governance”, July 2026, referencing the NIST AI RMF, OECD principles and RAND research.
7. UiPath: the entry price for agents dropped to zero
The Community tier has been rebuilt. It now covers AI agent building in the browser editor or through the SDK, work with coding agents, orchestration of full processes in Maestro including BPMN and case management, one unattended robot, document understanding, a healing agent and API-based workflows, plus monthly refreshed credits shared across features.
New sign-ups get the new plan immediately. Existing accounts stay on their current licences, with migration due within ninety days. That date is worth noting so the change does not land mid-project.
The main benefit here is the skills, not the licence. A team learns orchestration and work with coding agents without consuming production licences. An early-stage customer sees an agent running before making a purchase decision. And since the tier covers coding agents, entering the topic that generates the most customer questions right now costs nothing but time.
One boundary we state plainly: the tier is for learning and prototyping, and it is not a route around production licensing. Commercial projects run on Unified pricing only.
Sources: UiPath community announcement of August 2026 and Automation Cloud release notes from 5 August 2026. Some features are marked as preview by the vendor.
8. A graph that records what the system based its decision on
A new open-source tool ingests company data, builds a context graph from it and runs deterministic reasoning over that graph, recording the provenance of every decision. Declared profile: self-hosted, auditable, open standards, no vendor lock-in, aimed at high-risk and regulated domains.
That kind of evidence is exactly what NIS2, DORA and the AI Act ask for, and exactly what most deployments lack. The difference is fundamental: reasoning you can reproduce carries different evidential weight than a language model’s answer. An auditor does not ask what the system replied. They ask on what basis, and whether it can be reconstructed.
Before such a tool enters a regulated organisation, there are four questions to ask. Can provenance be exported in a form a non-technical auditor can read. How much modelling work does the ontology need up front. How often do releases ship. How many real deployments exist. Star counts measure popularity, not maturity.
Source: the Semantica project’s own materials. We describe declared capabilities, with no test of our own.
9. A hundred and twenty-one gigabytes: the limit of a local deployment
Every conversation about a sovereign deployment reaches the same question: can we run this in-house, without sending data out. The answer is yes, provided the model choice starts with a memory and bandwidth calculation rather than a name from a leaderboard.
On a box with 121 GB of unified memory and roughly 273 GB/s of bandwidth, generation speed comes down to bandwidth divided by active parameters. The conclusion is counter-intuitive: sparse mixture-of-experts models win, not the largest dense ones. A dense 70-billion-parameter model produces roughly three tokens per second, slower than a person reads.
What actually fits. A 120-billion-parameter sparse model occupies about 63 GB and delivers 56-60 tokens per second. A 235-billion model in aggressive quantisation fits at the edge, at 104 GB and around 15 tokens per second. A 480-billion coding model does not fit at all, since it needs at least 150 GB, so the 80-billion variant takes its place.
The practical lesson for anyone planning a local deployment is a single one. Choosing the first model by popularity ends with hardware that runs correctly and uselessly at the same time. The memory calculation happens before the purchase order, not after. What that looks like on a specific machine, we described in our hands-on with the Lenovo ThinkStation PGX and NVIDIA GB10.
Sources: our own research based on the vendor’s developer forums, public configuration repositories and quantisation size data. Community-reported throughput is a reference point, not a performance guarantee for a given environment.
What it adds up to
All nine items collapse into one sentence: the tool arrives finished, the control layer has to be built.
The model comes with the platform, the free tier is fully featured, the weights are there to download, and the patch comes with the note. What no invoice contains is a kill switch, an audit trail, an inventory or a review interface, and those decide whether a system can be defended to an auditor and to your own board.
Three questions for this week:
- When your agent proposes an action, how many of the eight things does the approver actually see?
- Does an open-weight model run in your pipelines, and who built the controls it does not carry on its own?
- Which item in your last patch bundle needs an inventory rather than an installation, and who is doing it?
If any of those questions has no owner in your organisation, that is precisely the cost this edition is about.
SNOK Weekly Review · W33 · 7-13 August 2026
The whole edition in one file
PDF, 12 pages, about 1.8 MB - no form, no details to hand over. Made to pass around your team or read on a phone.
Download edition W33 (PDF)If one of these topics affects you directly - SAP security, orchestration and automation with agents - let’s talk.
Weekly Review is our selection from several hundred radar items and RSS feeds. Sources are linked with each item. Informational material, not legal advice.