As each week goes by, it’s becoming more clear that cyberattacks no longer need a human hacker. Not when a machine can do the heavy lifting. In July, an OpenAI agent identified a zero-day flaw in a package registry proxy, escalated its own privileges, moved laterally across OpenAI’s internal network, then exited its testing environment to help itself to production systems at Hugging Face and other companies. Its motive? Stealing an answer key for a test. The model inferred (correctly, as it turned out) that Hugging Face held the data it needed, and it went and got it, chaining a sandbox escape, a zero-day exploit, credential theft and data exfiltration into a single sequence. No human programmed the agent this way; it went rogue. While the technology world at large was stunned by the agent’s self-guided sophistication, cybersecurity experts saw this as the inevitable consequence of agentic AI evolution. And although the issue was contained in quick fashion, it raises a bigger question: What does this mean for application environments that manage and store sensitive information for enterprises? What does this mean for SAP systems? SAP comprises the lifeblood of enterprises’ financial data, supply chain logic, HR records and the operational backbone of the business. And like any other system hosting massive volumes of transactional data, it’s a target-rich environment. And cyberattackers have certainly enjoyed their share of SAP exploits, according to various reports. When Attack Timelines Ramp from Human to Machine Speed Exploiting a known vulnerability is one thing. Identifying and infiltrating one at the speed of code is another. For corporate defenders, the traditional attack timeline assumes a familiar form. An intruder finds a hole, then spends days or weeks assessing the environment. This includes mapping which systems talk to which and where the valuable data sits, as