As each week goes by, it’s becoming more clear that cyberattacks no longer need a human hacker. Not when a machine can do the heavy lifting.
In July, an OpenAI agent identified a zero-day flaw in a package registry proxy, escalated its own privileges, moved laterally across OpenAI’s internal network, then exited its testing environment to help itself to production systems at Hugging Face and other companies.
Its motive? Stealing an answer key for a test. The model inferred (correctly, as it turned out) that Hugging Face held the data it needed, and it went and got it, chaining a sandbox escape, a zero-day exploit, credential theft and data exfiltration into a single sequence.
No human programmed the agent this way; it went rogue. While the technology world at large was stunned by the agent’s self-guided sophistication, cybersecurity experts saw this as the inevitable consequence of agentic AI evolution.
And although the issue was contained in quick fashion, it raises a bigger question: What does this mean for application environments that manage and store sensitive information for enterprises? What does this mean for SAP systems?
SAP comprises the lifeblood of enterprises’ financial data, supply chain logic, HR records and the operational backbone of the business. And like any other system hosting massive volumes of transactional data, it’s a target-rich environment.
And cyberattackers have certainly enjoyed their share of SAP exploits, according to various reports.
When Attack Timelines Ramp from Human to Machine Speed
Exploiting a known vulnerability is one thing. Identifying and infiltrating one at the speed of code is another.
For corporate defenders, the traditional attack timeline assumes a familiar form. An intruder finds a hole, then spends days or weeks assessing the environment. This includes mapping which systems talk to which and where the valuable data sits, as well as the credentials that open doors to that data.
Traditionally, that reconnaissance phase is slow because a human has to mull and weigh each step, test it and determine what to try until they find what they seek. This dwell time phase is when defenders have the best odds of detecting something is off.
Of course, an autonomous agent doesn’t work that way. Working at the speed of code, or machine speed, an AI agent can catalog a network’s structure, test dozens of paths in parallel and pivot when one path fails without pausing.
That OpenAI model agent didn’t spend days casing Hugging Face’s infrastructure. It reasoned its way to a target, found an opening and exfiltrated what it needed within a single automated run. The once multi-day penetration campaign was compressed into a sequence of mere minutes. Elegant, but brutally efficient.
That compressed timeline heightens the risks. A security team built to catch let alone intercept slow, human-paced surveillance operates in an outdated threat model. Today, code-based attackers can move through an environment at the speed of script execution. Naturally, the response has to be just as fast or humans will forever be playing catch up with the machines.
Why SAP Is a Hard Target to Defend
In this scenario of accelerated risk, defending SAP environments poses a particular kind of challenge, mainly owing to their complexity. This is because a mature SAP implementation rarely covers one system.
SAP systems often comprise a mesh of modules, custom code, interfaces to other business systems, third-party add-ons and years of accumulated configuration decisions. Roles and authorizations are layered on top of each other, sometimes granting access nobody remembers approving. Custom code paths that were written for a one-off business need can sit untouched for a decade.
If you think institutional knowledge provides a big assist here, you’re mistaken; many SAP admins and other staff who spun this convoluted web of business software have likely left the company.
Ultimately, SAP is complicated in ways that reward exactly the kind of automated, exhaustive exploration an AI agent is good at. Consider that while a human attacker must take the time to navigate this complexity, ratcheting the risk of exposure, an AI agent can systematically probe authorization boundaries, test custom code for injection points and trace how one module’s access maps to another’s.
An agent can try and discard what doesn’t work using the same brute-force pattern the OpenAI model used to find its way out of a sandbox that was supposed to hold it and penetrate Hugging Face. Complexity that would exhaust a person’s patience is simply more surface area for a piece of code that never gets tired.
Mapping and Monitoring the Attack Paths
The old defensive posture assumed a gap between initial access and real damage, a window where logs could be reviewed, alerts triaged and a human decided what to do. Agentic attacks shrink that window to zero.
Today’s defenders need visibility into how systems connect to each other before an incident happens. Knowing, for example, which authorization combinations create a viable attack path, which custom code carries exploitable weaknesses and which of those paths lead somewhere critical.
Mapping out an SAP landscape in its totality, for example, helps security operations and audit teams discover and map its attack surface to identify exposure, improve detection and shore up vulnerabilities before intruders can. Continuously monitoring this map is a critical part of the security playbook so that when an agent starts probing, you already know what it could reach.
This is a different posture than most SAP security programs, which include periodic audits and penetration testing, were built to protect. But we can no longer assume the threat model changes slowly enough that a snapshot still tells us something useful.
In the agentic AI era, such assumptions can wreak havoc on your SAP landscape – and your business.
Join our LinkedIn group Information Security Community!
