Weekly review W38: not the tool, the route

Ten items from the week of 11-17 September 2026, with a note on what each one changes in your systems.

The SAP Security Patch Day of 8 September carried a note rated 9.8. Four days later a public description of the mechanism existed, and that same evening there was a working proof in a lab. This is not a story about one vulnerability. It is the first of ten items in which the decision was never “which tool to buy”.

Every time it was a different question: which route to take. Patch the kernel or tighten an internal communication parameter. Monitor one route to bank details or all eight. Give the agent a document in an index or a live record in the system. Model the process in notation, in code or on a canvas. Put the clause on your side of the contract or leave it to the provider. These decisions are made once, usually early, and usually by someone who does not know they are deciding. Reversing them later is not reconfiguration, it is a rewrite.

1. Ninety-six hours from the note to working code

The SAP Security Patch Day of 8 September 2026 brought note 3759472, rated 9.8, HotNews category, no workaround. The flaw sits in the SAP Message Server: nothing verifies authenticity when a gateway entry is written, so after an ordinary protocol handshake an unauthenticated client supplies its own host, port and process identifier. The kernel accepts them and broadcasts the forged gateway identity to every application server in the landscape.

The mechanism is called trust-list pollution and it has two consequences. The first is an adversary in the middle of internal traffic, which is where single sign-on tickets and internal remote calls travel. The second is remote code execution without an account in the system.

What is interesting is not the flaw but the clock. 8 September, the note. The morning of 12 September, a public analysis of the kernel diff. The evening of 12 September, a working proof in the SecurityBridge Research Lab - with an AI coding assistant helping to reconstruct the data format, which the researchers state openly. By the researchers’ own account the actual work took two days; two of the four fell on a holiday.

Address-based controls do not gate this command family. Enforcing encrypted internal communication between instances closes the route more effectively, but it is an additional layer - switching the parameter off reopens the surface the same day. The durable fix is a kernel replacement.

What follows: if your SAP patching process plans quarterly windows, it is planning against an adversary who no longer exists. The 9.x kernel line is today’s S/4HANA mainstream, so most landscapes are in scope; the 7.x and 8.x kernels do not carry this command family.

Sources: SecurityBridge Research Lab, “CVE-2026-58240: From Patch Day to PoC in 96 Hours”; Onapsis, an analysis of the same vulnerability under the name S4GET; SAP Security Note 3759472. Retrieved 17 September 2026. Status: mechanism, rating and note number confirmed in two independent sources.

2. Eight routes to the same field

A vendor of SAP protection software demonstrated eight ways to change bank details in the system. Alternative transactions, transport mechanisms, custom development, interfaces and background processes. None of the eight raised an alert, because monitoring covered the intended route, the standard transaction.

The demonstration does not prove that SAP is badly designed - most alternative routes exist for sound operational reasons. It proves something else: a control built around one route does not see the others, and the same logic covers payment terms, credit limits, business partner master data, prices and discounts.

A second argument from the same source adds time. Network security learned this lesson over twenty years: detection systems compared traffic against signatures and raised an alarm, but by the time an analyst read it the packet had arrived. Only moving that logic into the traffic path allowed the packet to be dropped. SAP security today sits at the detection stage: the tool reports a suspicious call and hands the case to a human, and the gap between the two is all an attacker needs.

What follows: a role list answers who may come through the door. It does not answer who came through the window, or how quickly they will be removed. That is the difference between a conversation about compliance and one about operational capability.

Sources: SecurityBridge, “Breaking the Rules: Why Standard SAP Controls Are Not Enough” (Joris Van De Vis); the webinar “Break the rules: 8 ways to update Bank details in SAP”; material on runtime application self-protection. Status: vendor material, we did not replay the recordings. The figure of eight describes one demonstration environment, not a property of SAP.

3. Seventy-eight instruction files and six thousand stars

A package on GitHub turns a coding assistant into an offensive working tool. We counted the repository ourselves: 78 instruction files across 23 categories, loaded on demand, so unused ones cost the model no context. The repository was created in early March and today carries 6,011 stars.

The mechanism matters, not this particular package. We are not talking about an exploit that has to be compiled and run. We are talking about text files someone drops into an assistant’s directory, equipping it with a methodology. Your attack surface grows not by a tool but by a ready-made way of working - and that arrives with a single directory copy.

The operational conclusion is short: someone else’s agent instruction file is untrusted code, not documentation. Treating it as documentation is the same mistake as running a script from the internet without reading it. SNOK’s agent skill scanning checks such packages before installation for prompt injection, data exfiltration, privilege escalation and memory poisoning.

What follows: if anyone in your organisation extends assistants with third-party instruction files, you need a gate for it. Software procurement policy does not cover this case, because formally nothing was bought.

Source: the SnailSploit/Claude-Red repository on GitHub, metadata and tree structure retrieved 17 September 2026. Status: confirmed by our own measurement - the file count, category count, star count and dates come from the GitHub programming interface, not from a secondhand account.

4. Almost three thousand ready commands in a distribution package

A classic launcher for penetration testing commands has been rewritten in Go and packaged into the official Kali Linux repositories. The project description lists 247 tools, 2,926 commands and more than two hundred cheat sheets. Installation is one command, then you search the library and inject a ready command into the terminal.

This is not a new attack engine. It is a productivity layer over tools that have existed for years - and that is exactly why it matters. Set beside the previous item, it shows the barrier to entry on the offensive side dropping through two independent channels at once: ready commands in a system package and a ready methodology for an assistant.

What follows: your defence team is planning against an opponent who no longer has to remember syntax or the order of steps. When assessing security posture, the useful question is not whether someone can use a tool, but how long it would take you to notice that they did.

Source: the halilkirazkaya/arsenal-ng repository on GitHub, metadata retrieved 17 September 2026 - Go, MIT licence, 702 stars, last change 11 August 2026. Status: metadata confirmed by our own measurement; the figures of 247 tools and 2,926 commands come from the project description, and we did not count the library contents.

5. Grounding on documents answers a different question than grounding on data

UiPath has described a layer through which an agent reaches live records in a customer’s systems instead of working on vectors built from documents. UiPath Data Fabric models entities once and makes them available to every agent while preserving permissions.

The four requirements the material sets for agent-ready data make a good checklist regardless of platform. Access to the current state, not to last night’s extract. Structure that allows filtering and joining. Entity models built once for every team, rather than rebuilt in each project. Permissions and lineage by default, because otherwise every new agent is a new compliance surface.

The difference shows best in two questions. Similarity search will answer what the returns policy says, because the answer is a fragment of text. It will not answer which tickets in a given region are overdue, because that is a query with a filter and a join, and the answer is a number computed from rows.

What follows: an agent project that starts with document vectorisation ends with an assistant that is eloquent and inoperative. If the questions it must handle concern state rather than text, the data layer is the first architectural decision, not the last.

Source: UiPath material on the Data Fabric layer, September 2026. Status: vendor material without independent confirmation; the range of supported systems is not listed in it, so we name none.

6. Three orchestration patterns on one engine

The shortest statement of the boundary between two layers of the UiPath platform runs like this: Orchestrator manages the workers, and UiPath Maestro runs the process those workers are part of. Underneath sits a durable execution engine, so a process paused on an approval resumes exactly where it stopped and survives the failure of the system it depends on. You write neither a state machine nor your own retry layer.

Three patterns sit on that same engine, and this is where the decision belongs. You choose the structural pattern in process modelling notation when the path is known in advance, decisions are rule-based and auditability is critical - invoice handling, employee onboarding, regulatory reporting. You choose the code-first pattern when developers build the solution and the logic reads better in a repository than on a graphical canvas; the project serialises to a text format, so change review goes through version control like any other code. You choose the adaptive pattern when the next step cannot be predicted at design time, exceptions are the norm and a case runs for weeks - claims handling, customer verification, benefits assessment.

What follows: the pattern follows from the process, not from the consultant’s preference. Asked at the start, the question costs one conversation; skipped, it returns as a rewrite halfway through the project.

Sources: UiPath product material on Maestro and on the developer canvas, an article organising the three layers, community repositories with examples. Status: capabilities match vendor material; the developer canvas is in public preview and the source gives no general availability date, so we build no schedule on it.

7. Three routes to building an agent and the cost of picking the wrong one

The same platform offers three equal routes to building an agent: a Python software development kit, agents coded through the command line, and a browser canvas. The vendor material describes all three as first-class and does not say which to open first - and the community forum is full of threads about exactly that.

The decision is not a matter of taste. It is about how much control the team takes and how much of the work it accepts in return. The development kit gives the most freedom and the deepest integration with the language ecosystem, and expects the most work in return. The browser canvas gives the lowest barrier and the fastest start, paying with the least say over detail. The command line route keeps the code under version control, which fits the engineering practices your team most likely already has.

What follows: discussing the route at the start of a project costs an hour. Skipping it costs a rebuild, because switching route means building the solution again.

Source: UiPath material on the three routes to building an agent, September 2026. Status: vendor material.

8. Quadrant leader, a deployment with numbers and the argument about the end of robotic automation

Three materials from a single week address the three objections that always arrive in the same order in a conversation about agents.

Is the vendor serious. UiPath was positioned as a leader in the Gartner quadrant for intelligent document processing solutions for the second consecutive year; the report is dated 8 September 2026.

Has anyone actually run this. A case study of the Philippine telecommunications operator PLDT describes three agents in production, built so that software robots act as the agent’s tools. The knowledge assistant answers in one to three seconds instead of one to five days and removes 25,000 to 30,000 manual hours a year, which the material converts into the capacity of roughly twelve full-time roles. The risk assessment agent, deployed in February 2026, shortens tasks that took two to ten days into a range of five minutes to one day.

Are we buying technology on its way out. Here the answer is the most interesting one, and it does not come from the vendor. Producing an answer is not the same as closing a process. A model will read an invoice, extract the data and flag a discrepancy. Closing the process requires validation against rules, approvals tied to financial thresholds, updates across several systems, an audit trail and deadline tracking. These are execution problems, not intelligence problems - and robotic process automation is not so much disappearing as ceasing to be an imitation of a human at a screen and becoming the execution layer beneath a decision taken higher up.

What follows: the measure of success changes too. The number of robots deployed and hours saved lose their meaning in favour of whether the work moves faster without loss of quality, and whether recommendations can be carried out consistently under supervision.

Sources: the UiPath investor announcement on the quadrant position (Gartner report dated 8 September 2026); the PLDT case study published by UiPath and reported by three independent trade publications between 10 and 15 September 2026; a Forbes Technology Council article on the boundary between intelligence and execution. Status: the position and report date are confirmed; the deployment figures come from the vendor’s case study and are not our measurement. Gartner does not endorse vendors or products, and its publications are opinions of a research organisation, not statements of fact.

9. Twenty-four clauses and the question of who carries the risk

A practising lawyer has assembled a catalogue of contract provisions for artificial intelligence systems in two roles: eighteen protecting the party deploying the system and six protecting the provider. The value of the compilation is that both lists stand side by side, so you can see where the interests part ways.

On the deploying side the same points recur: no training of the model on data entered by users, notification of changes to the system with a right to object, no processing outside the European Economic Area with a list of locations, genuine human oversight functions including immediate shutdown of the system, and migration support after the contract ends. On the provider’s side - the right to use data for training and development, changes of subcontractors and locations without consent, and a closed description of functions beyond which the provider is not liable.

Three remarks from the discussion under that material weigh more than parts of the list itself. Training is not the same as retention - the model does not learn in real time, and the risk sits in what the provider collects and for how long. Change notification must cover a swap of the underlying model and of request routing, because the same case can receive a different answer than it did a week earlier, with the contract unchanged and the interface unchanged. Contractual liability does not replace confirmation that the system may be used at the moment of use.

The timeline is also worth setting straight, because an incorrect version circulates. The AI Act applies in stages, and an amending package moved some of them. Obligations for high-risk systems under Annex III apply from 2 December 2027, and for systems under Annex I from 2 August 2028. The claim that the high-risk rules have applied since August 2026 is false.

What follows: the compliance conversation moves from the slide deck to the contract annex. If you are buying an AI system, the question is not “is the provider compliant” but “which of these twenty-four provisions made it into our copy”.

Sources: a practitioner’s series of posts on contract clauses, August and September 2026; the AI Act, article 113 as amended. Status: the application dates are confirmed; the catalogue of clauses is a practitioner’s opinion, not a source of law. This is not legal advice - review by a lawyer is required before applying any of it.

10. A hundred and eighty billion parameters at a desk, and three different licences

A dense model of 27 billion parameters fits in roughly 17 gigabytes after four-bit quantisation and carries a native context of 262,000 tokens under Apache 2.0. That alone changes the arithmetic for an organisation that does not want to send data outside. A community-published recipe goes further: it serves a sparse variant of 180 billion parameters on a single desk-class device at around 60 tokens per second on one stream.

The second point is less striking and more important. Three variants of the same family carry three different licensing regimes. The base model sits on an open licence with no thresholds. The short-reasoning variant is free up to an organisational revenue threshold, above which a commercial licence is required. The sparse variant permits commercial use but excludes serving the model as a service. Three different answers to the same question, within one model family.

What follows: the data sovereignty conversation stops being a choice between quality and control and becomes an arithmetic exercise - where exactly the line falls for the size of your workload. The licence is checked before the quote, not after the deployment.

Sources: the Qwen3.8-27B model card on Hugging Face; the short-reasoning variant’s model card with the vendor’s own measurement table; a community recipe for serving the sparse variant, version dated 14 September 2026. Status: the base model’s parameters and licence are confirmed at source; the speeds come from one author’s recipe description and are not our measurement.

One sentence for this week

The ten decisions in this week’s issue share one trait: none of them has a line of its own in the budget or in the risk register. The route is chosen in a technical conversation, in a comment on a contract, or by a tool’s default setting - and its price appears only at the first audit, the first incident, or the first policy change that cannot be made without rebuilding the solution.

Hence one practical question for your next review: which of these decisions have already been made here, and who made them. If nobody can name that person, the decision still exists - the default setting made it.

If any of these items concerns you directly - SAP security, or orchestration and automation with agents - let’s talk.