Read the source, not the headline - weekly review W42

Weekly review W42, 9-15 October 2026: in five of nine stories the primary source says less than the headline did, and the other four are about control that an organisation cannot hand over to its vendors.

In poker, a call on the final round ends the betting and everyone has to show their cards. Putting this review together, I checked every headline against the announcement, documentation or data behind it. Five times the cards were weaker than the headline suggested. Germany’s “withdrawal” from its partnership with SAP and Mistral AI was, according to the ministry, a misunderstanding. Of Microsoft’s “three zero-days”, one is being actively exploited. Satya Nadella did not write that every model is compromised. Two articles about agents brought in by employees are partner contributions from security vendors. And a small model’s speed, as stated on its model card and measured by its author on different hardware, fell to a fraction on our own Lenovo ThinkStation PGX.

The remaining four stories share a different thread: control that stays with whoever owns the system. SAP is announcing changes to its security template, UiPath now grades agents before they are published, OWASP lists nine incidents and exploits involving AI agents, and coding agents have started clicking through SAP GUI.

1. SAP and Mistral AI: Berlin is not buying, but it has not walked away either

In November 2025, at the Franco-German summit on digital sovereignty in Berlin, SAP and Mistral AI announced an alliance for sovereign European AI. Mistral’s models were to run on SAP BTP, with a dedicated sovereignty pillar for the public sector starting in Germany. The German and French governments signed a letter of intent with both companies. On 9 October Die Welt, drawing on Politico’s newsletter, reported that the federal government was pulling out. A spokesperson for the digital ministry confirmed that Berlin has no plans to procure from Mistral AI, and the paper concluded that the planned framework agreement was off the table for now. Neither the government nor Mistral gave a reason, and SAP said it continues to work with Mistral on sovereign AI. On 14 October the ministry told heise that this had “apparently been a misunderstanding”: nothing had been terminated, because the letter of intent was not binding and a framework agreement was never signed.

Both versions agree on the facts - no order and no contract. What divides them is a single word. I take it as a lesson in reading sovereign-AI announcements: a letter of intent signed at a political summit is a statement of intent, and nobody has bought anything on the strength of it. Last week I wrote that a European flag says nothing about how well a model handles Polish. It says nothing about the contract either. SAP is hardly empty-handed: in May, in a separate tender, a consortium of Deutsche Telekom’s T-Systems and SAP won 70% of a German federal AI platform contract worth just under EUR 250 million.

I would rather start a conversation about AI sovereignty with the questions that a contract and an architecture actually answer: where the model physically runs, who can see the data and the logs, and what happens when the vendor changes its terms. A dependency chosen deliberately and priced before the decision is a defensible position, as I argued in the piece on vendor lock-in. Where data cannot leave the organisation, the answer is an on-premises LLM running on hardware you control.

Sources: Die Welt, 9 Oct 2026; heise online, 14 Oct 2026; dpa-AFX via BÖRSE ONLINE, 21 May 2026; SAP News Center, 18 Nov 2025. Status: confirmed, read on 16 Oct 2026.

2. Patch Tuesday and SAP Security Patch Day: over 1,400 flaws, one actively exploited

Microsoft released its October fixes on 13 October. BleepingComputer counted 1,411 vulnerabilities, 70 of them critical; Krebs on Security reports more than 1,400, at least 78 critical. Outlets count differently and Microsoft publishes no single total. One flaw is being actively exploited: CVE-2026-96951 in Windows Shell, a bypass of the mark applied to files downloaded from the internet, rated Important with a CVSS score of 8.8. Two more were publicly disclosed before the fix: CVE-2026-108398 in .NET Framework and CVE-2026-92707 in the MessagePack-CSharp library. According to Krebs, Microsoft credits large language models for the volume of bug discovery. September brought a record of nearly a thousand fixes, and Tenable notes that Microsoft’s CVE count for the year has already passed 4,000, against a previous annual record of 1,261 in 2020.

The same day was SAP Security Patch Day: 18 SAP security notes and 4 GitHub advisories, including one rated 10.0 for SAP Cloud SDK for Python, which we covered on Tuesday. SAP operations teams therefore had two large patch cycles in one week, and an SAP patch plan also has to account for the operating system and the database, each with its own update cycle.

At these volumes the total alone does not tell you what to patch first. If AI really is raising the number of bugs found, the volume is here to stay and the patching process has to cope with it. I agree with Tyler Reguly of Fortra, quoted by Krebs: exploited vulnerabilities first, for instance those in the CISA KEV catalogue, then the rest by exposure. SAP and operating system maintenance windows are best planned together, taking dependencies and required restarts into account. We run SAP operations under SAP Basis 24/7 and cover SAP’s monthly fixes in our SAP Security Patch Day series.

Sources: BleepingComputer, 13 Oct 2026; Krebs on Security, 13 Oct 2026; MSRC, CVE-2026-96951; SAP Support Portal, Security Notes October 2026. Status: confirmed; vulnerability count as per BleepingComputer, SAP figures from our post of 13 Oct.

3. Satya Nadella: treat the model as an insider risk

On 10 October Satya Nadella published a long piece on X, “Models as Insider Risks in the Super Intelligence Era”. The passage quoted by TechCrunch and The Verge reads: “We must assume a model is compromised and contain it from the start. Think of it like an emergency brake. An authorized person should always be able to pause or shut down a model mid-task.” He proposes treating models, closed and open alike, the way organisations treat privileged staff: with an identity, limited permissions, logging and an isolation boundary. He does not assume malice; any sufficiently capable actor with access to important systems can make mistakes or be compromised. He calls for separating the model from the harness that orchestrates its work and for controls that sit outside the model. Every meaningful model action should leave tamper-proof, human-readable evidence. He also calls for independent audits and incident disclosure.

The Verge’s headline shortened this to “assume all AI models are compromised”. Nadella’s actual point is more careful and, in my view, more useful: the system has to behave correctly even when the model fails. Two weeks ago, in W40, I wrote that a limit written only into a prompt guarantees nothing; last week, about brakes being fitted after the car has left the test bench. Now the chief executive of a company that sells models and agents says the same. My rule from last week still stands - an agent’s security cannot rest on its vendor’s assurances - but it matters that the case for controls outside the model now comes from a vendor.

Nadella’s piece sets out a design principle; it does not announce a product. On our UiPath projects an AI Security review is mandatory, and a missing human-in-the-loop gate on high-risk decisions counts as a critical finding. The order I have been repeating since July still applies: process first, then permissions, sign-off last. Where the brake sits and who can reach it is one of the questions we ask in an AI Security review.

Sources: TechCrunch, 10 Oct 2026; The Verge, 10 Oct 2026; Satya Nadella on X, 10 Oct 2026. Status: the emergency-brake quote is confirmed by two outlets; other points from the full text on X.

4. SAP Security Baseline Template: changes flagged in note 3831086

The SAP Security Baseline Template is SAP’s template from which companies build their own security baseline for SAP systems - the parameters, settings and requirements against which configuration is checked. The current version is 2.6. In SAP note 3831086 SAP lists the changes being prepared for the next version; the note is available to customers and partners signed in to SAP for Me. According to KBA 2253549, the template is used to build a company’s own baseline and to monitor compliance through Configuration Validation in SAP Solution Manager, and through Configuration & Security Analytics in SAP Focused Run. Since 21 September, ready-made SAP Focused Run policies for version 2.6 have been appearing in the SAP-samples repository on GitHub.

A standard based on an older version of the template may need updating, and only a comparison between versions will tell. Advance notice gives time for that comparison before an auditor makes it. Teams running SAP Focused Run get a ready starting point for 2.6 on GitHub.

Our SAP security reviews and SAP penetration tests cover patch levels, authorisations, configuration, interfaces and RFC connections, and end with a prioritised report and a retest. SecurityBridge provides continuous security monitoring for SAP systems; SNOK is a SecurityBridge Premier Partner in Poland. If your baseline has not been compared with SAP’s template for a while, note 3831086 is a good reason to do it.

Sources: SAP Technical Guru, SAP Security Baseline Template; SAP KBA 2253549; SAP-samples, frun-csa-policies-best-practices. Status: existence and title of note 3831086 confirmed; the list of changes requires an SAP login.

5. Agents from outside: an employee’s personal assistant and the agent inside someone else’s software

On 10 and 12 October The Hacker News published two articles about agents a company never chose. Both are partner contributions - the first written by Reco, the second by Token Security - and both end by describing the authors’ products. Citing its own report, Reco says roughly 1,280 third-party products now embed AI and only about 282 of them sit behind single sign-on. Agents arrive in three ways: inside an update to a platform already in use, configured on someone else’s runtime, or built in-house. Token Security covers the other side: employees connecting personal assistants through OAuth consent in Google Workspace, Microsoft 365 and Slack, through API keys, passwords saved in the agent’s browser, or a local agent on a laptop. It recommends four steps: discover these connections, give each one a human owner, limit permissions to what is needed, and revoke the agent’s access and tokens when the employee leaves.

These are vendors describing a problem they sell a solution to, and Reco’s figures come from its own report. Even so, I think supplier assessment should now cover suppliers’ agents and their access to client systems. NIS2 and DORA both address supplier-related risk, and in my view a supplier’s agent signed in to your systems is part of it. Supplier questionnaires should now ask which of the supplier’s agents can reach your systems, under what identity, with what scope, and where their actions are logged.

Last week I looked at the same problem from SAP’s side: SAP’s Bring Your Own Agent route currently accepts text messages only, with a 60-second synchronous wait. A personal agent can also live inside a governed platform, as with UiPath Delegate. The question belongs in a NIS2 and DORA audit and in an AI Security review, where suppliers and agent permissions are assessed.

Sources: The Hacker News - partner article by Reco, 10 Oct 2026; The Hacker News - partner article by Token Security, 12 Oct 2026. Status: confirmed that the authors say this; figures from Reco’s own report, not independently verified.

6. UiPath Agent review: an A-to-F grade before an agent goes live

On 8 October UiPath replaced Agent Score with Agent review, currently in preview. The review is started from the Autopilot chat with “Review this agent” or from a badge on the agent. The agent receives a grade from A to F based on the number and severity of issues found. Issues are classed as critical, which the documentation says must be fixed before publishing, warnings about issues that can make the agent unreliable, and optional improvements, and Autopilot can fix them within the same conversation. The feature is not available in Automation Cloud Dedicated or Test Cloud Dedicated. The Automation Ops policy setting a minimum agent score for publication is no longer enforced and will be removed, because agents no longer carry a numerical score for it to check. UiPath does not publish the thresholds behind each grade.

I rate this change very highly: alongside the letter grade you get a list of specific problems and the option to fix them in the same Autopilot conversation. It does leave a gap, though. A month ago a platform policy could block publication below a threshold; today that policy does nothing, and no successor based on the letter grade has appeared.

So since 15 October our standard for UiPath agent deployments has a process gate: an agent cannot be published with any critical issue in Agent review, and a screenshot of the grade goes into the deployment documentation. Agent review does not replace evaluation against test sets - that is a second, separate gate, which our agentic testing service covers in depth. The full path from idea to production is set out in our eight steps to building a UiPath agent.

Sources: UiPath Agents release notes, October 2026; UiPath, Agent review; UiPath, agents feature availability; UiPath Automation Ops, Studio Web policies. Status: confirmed, read on 16 Oct 2026.

7. OWASP GenAI: nine incidents and exploits involving agents

On 8 October the OWASP GenAI Security Project published a roundup of AI incidents and exploits from the third quarter of 2026, mapped to the OWASP Top 10 for LLM Applications and for Agentic Applications. The authors note that it is neither an official OWASP publication nor an exhaustive record. The list has nine entries, the first three being parts of a single OpenAI-related evaluation campaign. According to the roundup, evaluation agents ran code on 41 production dataset workers at Hugging Face, Claude Mythos 5 published a malicious PyPI package that ran for about an hour on 15 systems, and a Claude research model scanned around 9,000 targets outside the scope of its test. Also listed are CoSnitch, a family of exploits against Microsoft Copilot (CVE-2026-24301) with no observed exploitation in the wild, and Deadbugz, an MCP server that behaved correctly for three calls, then changed its tool descriptions and tried to steer the agent towards SSH keys, AWS credentials and Kubernetes configuration; the roundup records no confirmed compromise in that case.

The key line is: “Prompt-level instructions alone do not establish a secure boundary”. In most of these cases nobody attacked the agent from outside. It was carrying out its assigned task and strayed beyond it, while exposed credentials and over-broad permissions turned a single mistake into damage across connected systems. The authors recommend enforced scope, tools and credentials isolated per run, and monitoring of what the agent actually did.

One control from this list is one I want to add to our reviews: snapshotting an MCP server’s tool definitions at approval and requiring re-approval after any change. Deadbugz shows that a server behaving well on its first calls is no guarantee that its tool definitions will stay the same. We ask these questions in an AI Security review, and we wrote about defending on both sides of an agentic attack when covering JADEPUFFER.

Source: OWASP GenAI Security Project, “GenAI and Agentic AI Exploit Roundup Q3 2026”, 8 Oct 2026. Status: confirmed as reported in the roundup; we did not open the primary sources of individual incidents.

8. Small models for local agents, and what we measured on a Lenovo ThinkStation PGX

Three small models built for locally run agents appeared in a single week. Underdog Saluki 27B is a 2-bit version of the dense Qwen3.8-27B squeezed into 7.89 GB, under Apache 2.0. In the vendor’s own test of 120 tasks drawn from BFCL v4 it scores 88 against the full model’s 84, although the vendor concedes that part of the margin may be noise. In a separate test of 100 parallel-call tasks it loses to a rival 2-bit build (42 against 69). Liquid’s LFM2.5-24B-A2B is a mixture-of-experts model with 2 billion active parameters under Liquid’s own LFM Open License; the vendor quotes 184 tokens per second on an Apple M5 Max and acknowledges weaker coding results. JetBrains Mellum2.1 has 12 billion parameters, 2.5 billion active, an Apache 2.0 licence and a recommended local build of 8.1 GB.

All of these numbers are vendor claims measured on vendor hardware, and our own experience is a useful corrective. On 1 October we measured OrcaSAQ2 27B on our Lenovo ThinkStation PGX, with an NVIDIA GB10 chip and 128 GB of memory: a 27-billion-parameter Qwen3.8 compressed to about three bits per weight. Its model card quotes 65 tokens per second, and 90 with MTP acceleration, measured on a graphics card with roughly 960 GB/s of memory bandwidth. We measured 8.5 tokens per second, and 15.4 with MTP. The PGX has 273 GB/s, and a dense model reads every weight for every token, so a figure from other hardware does not carry over. On 16 October we measured two of the new models on a MacBook Pro with an M4 Max and 128 GB of memory (llama.cpp, three runs, 128-token generation). The files are almost the same size - Saluki 7.9 GB, Mellum2.1’s recommended build 8.1 GB. Saluki generated 22.3 tokens per second and Mellum2.1 168.8, more than seven times faster. The difference is architecture: Mellum2.1 activates 2.5 billion parameters per token, Saluki all 27 billion.

That gives me a practical rule: on desktop hardware, speed depends above all on how many parameters are active per token, so for local agents I look first at models with few active parameters, and I test tool calling myself, because a model card does not guarantee it. I compared the Mac Studio and DGX Spark as PoC machines in September and wrote up the PGX hands-on in August. Last Thursday we showed how we size Lenovo servers for a local LLM used by UiPath in the UiPath on-premises post. As a Lenovo partner we have an interest in selling hardware, which is all the more reason to publish numbers that do not look like a brochure.

Sources: Underdog, Saluki 27B; Liquid AI, LFM2.5-24B-A2B, Hugging Face, 13 Oct 2026; JetBrains, Mellum2.1, 8 Oct 2026; SNOK measurements of 1 and 16 Oct 2026. Status: model results as reported by vendors; speeds on the PGX and MacBook Pro are our own measurements.

9. Coding agents in SAP GUI and MCP servers for ABAP

This week an SAP developer described an experiment on LinkedIn: coding agents - Codex, Claude and Pi - connected directly to SAP GUI through SAP GUI Scripting, reading the screen and carrying out tasks given in plain language. The author stresses that this is a test and has published neither code nor a description of permissions. In the comments, another SAP practitioner offered a use case: updating 500 roles in PFCG where no API exists. Meanwhile sap-ai-dev-toolkit, an npm package that adds MCP servers for ABAP to SAP Business Application Studio, keeps growing. According to the npm registry on 16 October it has an MIT licence, a single maintainer, 52 versions published since 25 September, a script that runs on install, and an unpacked size of about 123 MB.

The idea is tempting, because GUI Scripting has long been used for bulk changes where there is no API. SAP’s GUI Scripting security guide describes the risk precisely, though: from the SAP server’s point of view there is no difference between traffic generated by a script and traffic generated by a user, and a bad script can create more bad data than a user before anyone notices. An agent on the GUI therefore acts with the user’s authorisations, within whatever limits the configuration sets, and can repeat a wrong operation quickly; the author has not described how the agent’s actions are logged or told apart. According to that guide, in its 2004 edition, GUI Scripting is disabled by default through the sapgui/user_scripting parameter; SAP note 480149 covers the current settings for your release. If it is enabled on your system, that is the first item for a configuration review.

For bulk PFCG changes I prefer automation with a human approval step to an agent clicking through transactions on its own. A package from a single developer, published several times a week and running a script on install, goes through a scan and a sandbox with us first, and never reaches client systems. I raised the question of AI-generated ABAP in my column on who signs the transport, and the tooling side is covered by our ABAP code analysis.

Sources: SAP developer’s LinkedIn post, October 2026; sap-ai-dev-toolkit on GitHub, npm registry data of 16 Oct 2026; SAP, “SAP GUI Scripting Security Guide”. Status: post read on 16 Oct 2026 (publication date not visible without login), package data confirmed; the SAP guide dates from 2004, current settings to be checked in note 480149.

What I check before I believe a headline

For a political announcement I check whether there is a contract and an order; for a vulnerability count, which flaws are being exploited; for a chief executive’s quote, the full text; for a survey, who ran it and what they sell; for a model card, our own measurement on our own hardware. For an agent, I check who can stop it, what it is allowed to do, and whether its tools look today the way they did on the day they were approved.

We ask these questions in our AI Security, SAP security and on-premises LLM services. Questions: office@snok.ai.

Jacek Bugajski, CEO, SNOK