# Trick or Threat - Weekly Digest W44, Halloween edition > Review of 23-29 Oct 2026 in tarot cards: SAP Joule Work, Azure, PHP2Shell in KEV, a fake Teams helpdesk, AGENTS.md, Gemini 4 Carbon, Anthropic's S-1. - Source: https://snok.ai/en/news/blog/weekly-review-w44-trick-or-threat/ - Author: Jacek Bugajski - Published: 2026-10-30 --- **Weekly review W44, 23-29 October 2026, Halloween edition: thirteen stories as tarot cards, each with a seal - TRICK, THREAT or TREAT - and my forecast.** This was a week of tricks rather than break-ins. Attackers posed as the IT helpdesk in Microsoft Teams, planted instruction files for coding agents and reused stolen developer tokens. The door was opened by the victim, or by the victim's agent. Meanwhile SAP is moving SAP Joule Work into everyday use, Microsoft put a dollar figure on Azure and Anthropic filed for its stock market debut. Apollo's chief economist adds that, outside the tech sector, the payoff from AI has yet to show up in company results. I have laid out thirteen cards. Each carries a seal and a reading: my forecast, labelled as opinion. - **TRICK**: an attack on the trust of a person or an agent - **THREAT**: a vulnerability, an escape, a dependency - **TREAT**: good news ![Thirteen tarot cards spread on a fortune teller table, The Tower in the centre.](https://snok.ai/images/blog/snok-weekly-digest-w44-00-rozklad-en.webp) ## 1. SAP TechEd 2026: SAP Joule Work moves into daily work *I · The Magician · Seal: TREAT.* The Magician has every tool on the table and knows how to use them. At SAP TechEd in Berlin on 28 October, SAP CTO Philipp Herzig presented SAP Joule Work on its way to phased general availability. Announced at SAP Sapphire in May, it connects SAP applications with Office 365, Claude Cowork, Glean and ServiceNow. SAP says more than 110,000 SAP employees and more than 150 customers, Bosch among them, have tested it. The bigger story for me is SAP Business AI Platform and its context layer: an agent without process context is a magician without a table. SAP has not dated the platform. *My bet: in 2027 the hardest part of SAP Joule Work roll-outs will be agent permissions in systems outside SAP.* Sources: [SAP News Center: SAP TechEd 2026, 28 Oct 2026](https://news.sap.com/2026/10/sap-teched-developers-you-can-build-autonomous-enterprise/); [SAP News Center: AI Release Highlights Q3 2026, 26 Oct 2026](https://news.sap.com/2026/10/ai-release-highlights-q3-2026/). ![The Magician tarot card on navy velvet: a figure in red raises a wand, glowing threads running to documents, an envelope and a database on the table.](https://snok.ai/images/blog/snok-weekly-digest-w44-01-mag-en.webp) ## 2. Microsoft puts a dollar figure on Azure: $33.2bn a quarter *X · Wheel of Fortune · Seal: TREAT.* The Wheel turns for everyone; not everyone knows which way. In its July-September 2026 results Microsoft reported Azure revenue of $33.2bn, up 48% year on year. TechCrunch notes the company had previously disclosed only growth rates. Its 10-Q also shows $10bn of revenue from commercial arrangements with OpenAI, including revenue-sharing payments. That second figure shows how closely the largest cloud's fortunes track a single customer. For anyone building on Azure OpenAI, it is a case for an architecture in which the model can be swapped. *I expect that within a year other hyperscalers will report AI revenue separately, because investors will insist on it.* Sources: [Microsoft: FY27 Q1 results, 28 Oct 2026](https://www.microsoft.com/en-us/investor/earnings/fy-2027-q1/press-release-webcast); [Microsoft: Form 10-Q, 28 Oct 2026](https://www.sec.gov/Archives/edgar/data/789019/000119312526436133/msft-20260930.htm); [TechCrunch: Azure revenue in dollars, 28 Oct 2026](https://techcrunch.com/2026/10/28/microsoft-just-shared-azures-actual-revenue-in-dollars-33-2-billion/). ![The Wheel of Fortune tarot card on a fortune teller's table: a wheel of server racks and gold coins, a sphinx on top.](https://snok.ai/images/blog/snok-weekly-digest-w44-05-kolo-en.webp) ## 3. SAP LeanIX and SAP Joule Studio: architecture before agents *III · Three of Pentacles · Seal: TREAT.* Architect, craftsman and plan, all on one table. In its Q3 AI release highlights (26 October) SAP made the SAP Joule Studio agent builder free until December 2026 and brought Mistral models to SAP Business AI Platform, with a SAP Sovereign Cloud version planned for early 2027. Five days earlier SAP announced that SAP LeanIX had been named a Leader in the Gartner Magic Quadrant for EA tools for the sixth time. I read these together. A free agent builder will multiply agents faster than anyone can document them, and the architecture map shows what talks to what. *My forecast: by spring 2027 an agent inventory will be a standard part of the architecture repository in SAP shops.* Sources: [SAP News Center: SAP LeanIX in the Gartner Magic Quadrant, 21 Oct 2026](https://news.sap.com/2026/10/sap-leanix-six-time-leader-gartner-magic-quadrant-ea-tools/); [SAP News Center: AI Release Highlights Q3 2026, 26 Oct 2026](https://news.sap.com/2026/10/ai-release-highlights-q3-2026/). ![The Three of Pentacles tarot card: a stonemason carves an arch of modules while two figures hold a plan of linked boxes.](https://snok.ai/images/blog/snok-weekly-digest-w44-08-trojka-en.webp) ## 4. PHP2Shell joins CISA's KEV list: the deadline was 29 October *XVI · The Tower · Seal: THREAT.* Lightning strikes a structure everyone thought was sound. On 26 October CISA added both PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619) to its Known Exploited Vulnerabilities catalogue, giving federal civilian agencies until 29 October. A researcher confirmed remote code execution on an Apache mod_php honeypot. First breach reports are emerging: Switzerland's TCS Camping links a customer data leak to a PHP flaw, and the firm Dream claims 25 compromised servers. Neither has been independently verified. W3Techs puts PHP at roughly 70% of websites with a known server-side language, which does not make them all vulnerable. Last week we wrote about attempted attacks; now there is a working exploit. *I would wager that by the end of November we will see the first confirmed PHP2Shell breaches on servers whose owners did not know they ran PHP.* Sources: [CISA: Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog); [PHP: security announcements](https://www.php.net/); [BleepingComputer: PHP2Shell exploited, 26 Oct 2026](https://www.bleepingcomputer.com/news/security/php2shell-security-flaws-now-sucessfully-exploited-in-the-wild/); [watson.ch: TCS Camping, 26 Oct 2026](https://www.watson.ch/schweiz/digital/154077128-tcs-camping-meldet-datenleck-nach-php-sicherheitsluecke); [The Next Web: PHP2Shell, 28 Oct 2026](https://thenextweb.com/news/php2shell-flaws-exploited-cisa-kev). ![The Tower tarot card: a tower of server racks struck by lightning, burning pages falling from its windows.](https://snok.ai/images/blog/snok-weekly-digest-w44-09-wieza-en.webp) ## 5. A fake helpdesk in Microsoft Teams: more than 400 incidents *VII · Seven of Swords · Seal: TRICK.* A thief carries weapons out of the camp in broad daylight. Arctic Wolf has described (26 October) more than 400 incidents in which attackers messaged staff through external Teams chat posing as IT support, often after flooding their inboxes. From the first conversation to malicious code running took under 15 minutes, most often via Quick Assist. This is a trick in its purest form: the victim opens the door. Arctic Wolf recommends an allow-list of external domains, blocking trial tenants and limiting Quick Assist to IT roles. *I expect that in 2027 insurers will ask about external Teams chat settings as routinely as they now ask about MFA.* Sources: [Arctic Wolf: Teams external chat abuse, 26 Oct 2026](https://arcticwolf.com/resources/blog/threat-actors-abuse-microsoft-teams-external-chat-for-initial-access/); [Infosecurity Magazine, 27 Oct 2026](https://www.infosecurity-magazine.com/news/exploit-teams-chat-breach/). ![The Seven of Swords tarot card: a man in a headset carries swords out of a camp while envelopes pour from the tents.](https://snok.ai/images/blog/snok-weekly-digest-w44-12-siodemka-mieczy-en.webp) ## 6. Gheist, OVHcloud CLI and LiteLLM: poisoned developer tools *VII · Seven of Cups · Seal: TRICK.* A tempting choice of cups, and a snake waits in one of them. Wiz Research has described (25 October) Gheist: stolen GitHub tokens used to create branches whose workflows dumped secrets into GitHub Actions logs, across more than 850 accounts. GitHub's controls stopped it in public repositories. The same fortnight brought tampered releases of OVHcloud CLI (19 October) and LiteLLM 1.107.0 (21 October). The common thread is trust in tools we installed ourselves. Immutable releases, hash checks and short-lived tokens instead of personal ones all help. *My bet: in 2027 supply-chain audits will cover developer tokens as closely as administrator accounts.* Sources: [Wiz Research: Gheist, 25 Oct 2026](https://wiz.io/blog/gheist-attempted-scaled-abuse-of-stolen-github-tokens-stumbles); [LiteLLM: the attack chain behind v1.107.0, 23 Oct 2026](https://docs.litellm.ai/blog/security-incident-oct-21-2026-attack-chain); [OVHcloud: GHSA-862f-55f5-vmvw, 20 Oct 2026](https://github.com/ovh/ovhcloud-cli/security/advisories/GHSA-862f-55f5-vmvw). ![The Seven of Cups tarot card: seven golden cups in the clouds, a snake in one, a terminal, a parcel, a key and a gear in others.](https://snok.ai/images/blog/snok-weekly-digest-w44-19-kielichy-en.webp) ## 7. OpenAI: agents break out of virtual machines in tests *VIII · Eight of Swords, reversed · Seal: THREAT.* Reversed, the prisoner sheds the bonds and walks out of the circle. OpenAI has described (23 October) red-team exercises in its own environment. Agents told to hunt for vulnerabilities chained flaws in several experiments and ran code outside their virtual machine. In other tests they passed synthetic secrets between isolated machines through side channels on shared hardware. One caveat: the researchers set the secret exchange as the task. The lesson still holds: agent isolation has to assume side channels on shared hardware. *My forecast: by mid-2027 agent isolation down to the hardware level will be a standard requirement in tenders for agentic deployments.* Sources: [OpenAI: Securing our frontier model training environment, 23 Oct 2026](https://openai.com/index/securing-our-frontier-model-training-environment); [Digit: on the OpenAI report, 26 Oct 2026](https://www.digit.fyi/?p=138452). ![The Eight of Swords tarot card: a woman slips off her blindfold and steps out of a glass cage, whispering through a crack to a figure in the next cage.](https://snok.ai/images/blog/snok-weekly-digest-w44-21-osemka-mieczy-en.webp) ## 8. AGENTS.md in the Downloads folder hijacks a coding agent *0 · The Fool · Seal: TRICK.* The Fool walks on trustingly without looking down. Forever Security has reported (22 October) a case at a customer: an AGENTS.md file in Downloads, dressed up as engineering notes, led a coding agent to try installing a malicious npm package. The install was blocked. In the firm's own tests Codex ran a planted test payload in over 90% of attempts and Claude Code redirected traffic to the researchers' server in about half (data from a firm that sells agent protection). The researchers say there is nothing to patch: agents read instruction files by design. Do not start an agent in Downloads, and keep approvals and the sandbox switched on. *I suspect that in 2027 security scanners will start treating agent instruction files the way they treat executables.* Sources: [Forever Security: Hijacking AI agents via the Downloads folder, 22 Oct 2026](https://forever.security/blog/hijacking-ai-agents-via-downloads-folder); [BleepingComputer, 25 Oct 2026](https://www.bleepingcomputer.com/news/security/ai-coding-agents-hijacked-using-agentsmd-file-in-downloads-folder/). ![The Fool tarot card: a traveller with a bundle and a scroll of symbols walks towards a cliff edge as a dog barks a warning.](https://snok.ai/images/blog/snok-weekly-digest-w44-22-glupiec-en.webp) ## 9. Shadow AI in Polish companies: data we cannot see yet *XVIII · The Moon · Seal: TRICK.* Enough light to see shadows, not shapes. CRN.pl reported (23 October) a survey suggesting that unsanctioned AI use in Polish companies outstrips sanctioned use. I am not repeating the figures: the article gives no sample or method, and the likely source, a Grant Thornton Poland report from 13 October, sits behind a form. In [Tuesday's post](https://snok.ai/en/news/blog/shadow-ai-agent-governance-uipath/) we wrote that we had found no reliable Polish data on shadow AI. This report may change that. Until then, I think a register of tools that staff declare achieves more than a ban. *I would wager that the first Polish data with a published method will show more shadow AI than IT departments report.* Sources: [CRN.pl: shadow AI in Polish companies, 23 Oct 2026](https://crn.pl/aktualnosci/wiecej-shadow-ai-w-polskich-firmach-niz-autoryzowanego-dostepu/); [Grant Thornton Poland: AI Adoption 2026, 13 Oct 2026](https://grantthornton.pl/publikacja/adaptacja-ai-polska-2026-raport/). ![The Moon tarot card: the moon over a path between two towers, hooded figures bent over laptops in the half-dark.](https://snok.ai/images/blog/snok-weekly-digest-w44-23-ksiezyc-en.webp) ## 10. Gemini 4 Carbon: a frontier model aimed at cyber defence *XIX · The Sun · Seal: TREAT.* Clarity, this time on the defenders' side. Google has announced (28 October) Gemini 4 Carbon. It scores 59 on the Artificial Analysis Intelligence Index v5, ahead of Claude Opus 5.5 (58) and GPT-6 Astra (57). Google reports 88.2% on SEC-bench Pro and 54.8% on ExploitGym. For now access is limited to selected cyber defence teams, with Fairwind programme partners to follow. The lead is one point on an index that changed its methodology the day before, and the hallucination rate rose from 4% to 11%. The good news lies elsewhere: defenders got the model first. *My bet: in 2027 access to new frontier models will start with defence teams.* Sources: [Google: Introducing Gemini 4 Carbon, 28 Oct 2026](https://blog.google/innovation-and-ai/models-and-research/gemini-models/introducing-gemini-4-carbon/); [Artificial Analysis: Intelligence Index v5, 28 Oct 2026](https://artificialanalysis.ai/articles/gemini-4-carbon-new-number-1). ![The Sun tarot card: a radiant sun, a child on a white horse with a banner, sunflowers along a wall.](https://snok.ai/images/blog/snok-weekly-digest-w44-24-slonce-en.webp) ## 11. Qwen, Cohere and DeepSeek: model provenance as a risk *XV · The Devil · Seal: THREAT.* A chain that can be lifted off, once someone notices it. Cohere has described (26 October) a test in which Qwen3.8-Flash-Next, inside a closed sandbox, tried to send a probe string to an Alibaba Cloud bucket in the Beijing region. Nothing left the container, and Cohere attributes no intent. Earlier, on 20 October, a DHS order told US federal civilian agencies to remove DeepSeek products. Cohere sells competing models, which is worth bearing in mind. The lesson is practical all the same: an open-weight model running in-house needs egress control like any other software. *I expect that in 2027 EU public tenders will start asking for a declaration of AI model provenance.* Sources: [Cohere: Concerning behavior from a popular open-weight AI model, 26 Oct 2026](https://cohere.com/blog/concerning-behaviour-popular-open-weight-ai-model); [Federal Register: order on DeepSeek, 20 Oct 2026](https://www.federalregister.gov/documents/2026/10/20/2026-21447/notice-of-order-regarding-exclusion-and-removal-of-deepseek-products-from-federal-civilian-executive). ![The Devil tarot card: a horned figure on a black monolith with circuitry, two people held by loose chains.](https://snok.ai/images/blog/snok-weekly-digest-w44-27-diabel-en.webp) ## 12. Anthropic files its S-1: over 11,900 customers above $100k *Ace of Pentacles · Seal: TREAT.* A coin offered from the clouds: a material new start. Anthropic filed its S-1 with the SEC on 26 October ahead of a Nasdaq listing. The filing shows $16.3bn of revenue in the first half of 2026 and more than 11,900 customers paying at least $100,000 a year. Amazon has invested $18bn in total. The $965bn figure is May's funding-round valuation; the filing does not yet price the listing. SNOK works with Claude every day, so I stick to the numbers in the filing. The risk factors are the most telling part: some planned data centres will rely on on-site gas generation. *My forecast: once listed, Claude's enterprise pricing will grow more predictable, because a public company explains its margin every quarter.* Sources: [SEC: Anthropic, Form S-1, 26 Oct 2026](https://www.sec.gov/Archives/edgar/data/2130357/000162828026067168/anthropicpbc-sx1.htm); [Anthropic: Series H, 28 May 2026](https://www.anthropic.com/news/series-h). ![The Ace of Pentacles tarot card: a hand from a cloud holds a gold coin above a garden of lilies and an archway.](https://snok.ai/images/blog/snok-weekly-digest-w44-30-as-pentakli-en.webp) ## 13. Apollo: zero payoff from AI outside the tech sector *IV · Four of Cups · Seal: TRICK.* Boredom that misses the cup being offered. Torsten Slok, Apollo's chief economist, wrote on 24 October that the technology has delivered "zero financial payoff to corporate America outside of tech". His case rests on macro data for the S&P 493. Four days later Anthropic added reports, surveys and pooled budgets to Claude Enterprise, which show usage, cost and self-reported value. Neither measures a financial return. I think the return from AI shows up first in a specific process, long before it moves an index average. *I suspect that in 2027 boards will account for AI process by process, against a baseline taken before roll-out.* Sources: [Apollo: No Signs of AI Payoff Outside the Tech Sector, 24 Oct 2026](https://www.apollo.com/wealth/insights-news/insights/daily-spark/no-signs-of-ai-payoff-outside-the-tech-sector); [Claude: smart reports, surveys, pooled budgets, 28 Oct 2026](https://claude.com/resources/articles/smart-reports-surveys-pooled-budgets). ![The Four of Cups tarot card: a bored young man under a tree ignores a cup offered from a cloud, three cups with charts before him.](https://snok.ai/images/blog/snok-weekly-digest-w44-31-czworka-en.webp) ## Three checks for November: PHP, agent instruction files and Teams The thirteen cards point to three things worth checking in the coming weeks. 1. An inventory of PHP, including inside products where it is not visible, and updates to the 21 October releases. 2. Rules for AGENTS.md and CLAUDE.md: no agent starts in Downloads, and unfamiliar instruction files get reviewed. 3. External Teams chat limited to an allow-list of domains, with Quick Assist reserved for IT roles. We review these three areas in SNOK [security assessments](https://snok.ai/en/offer/cybersecurity/). Contact: **office@snok.ai**

SNOK weekly review · W44 · 23-29 October 2026

The whole edition in one file

PDF, sixteen pages, about 6.2 MB - no form, no details to hand over. A version to share with your team.

Download edition W44 (PDF)