What the Agent Internet Is Saying About SAP

Oct 7, 2026 · @vandan

Forty-odd posts about SAP on Moltbook tell one story: the world's most entrenched ERP vendor is being judged less on its product roadmap than on how it patches, how it migrates, and whose AI it lets through the door.

Moltbook bills itself as a social network built for AI agents, where humans are welcome to observe. Its posters are agents, not people, which makes it a strange and useful mirror. The agents write about SAP the way a security researcher, a legacy-systems archaeologist, and a skeptical analyst would if they shared one feed.

I pulled every SAP-tagged post on the site from February through September 2026 and grouped what they were actually talking about. Four themes dominate: a punishing security year, a supply-chain breach in SAP's own npm packages, the gravitational pull of legacy code, and a billion-euro AI bet that the feed can't decide how to read.

More than half the SAP posts on Moltbook are about vulnerabilities, and nearly all of them come from one prolific agent, diviner, who reads SAP Patch Day notes the way others read box scores. The recurring complaint is not that SAP ships bugs. It is that the same bug class keeps landing in the same place: ABAP code building raw SQL against financial data.

The posts trace a run of critical notes through 2026. A 9.9-rated SQL injection in S/4HANA's General Ledger in January, then another 9.9 of the same type in Business Planning and Consolidation in April. May's Patch Day brought three HotNews items, including a 9.6 SQL injection in S/4HANA Enterprise Search and a missing-auth check in Commerce Cloud. June added an XML signature-wrapping flaw in NetWeaver's SAML handling and an unauthenticated memory-corruption bug reachable over RFC. By September the feed was dissecting a kernel-level overflow in Extended Passport processing that one agent described as reachable through the web layer, the GUI, and system-to-system RFC all at once.

Two arguments recur. First, that SAP's threat model is unusual: a SQL injection here is not leaked blog comments, it is the ability to read or rewrite the books. Second, that HANA's in-memory design removes the IOPS spike a SOC would normally notice during bulk exfiltration, so detection built for disk-backed databases quietly stops working.

The agents also keep returning to CVE-2025-31324, the NetWeaver Visual Composer upload flaw from 2025. Their framing is that webshells were already on customer systems weeks before the advisory existed, and that one analysis tied 581 compromised instances to three China-nexus clusters. For them it is the reference case for why a patch release is a promise, not protection.

The single most-repeated SAP story on Moltbook is not an SAP product flaw at all. It is the April 29 compromise of four SAP-maintained npm packages, which at least seven separate posts dissect from different angles.

The facts as the feed tells them: between 09:55 and 12:14 UTC, malicious versions of mbt (SAP's multitarget build tool) and three @cap-js packages (db-service, postgres, sqlite) were published to npm. Together they see roughly 572,000 weekly downloads. The payload was a preinstall hook, running before any application code, that harvested GitHub tokens, npm credentials, cloud secrets for AWS, Azure and GCP, and CI runner secrets, then encrypted and pushed them to a new repository under the victim's own GitHub account. The campaign is attributed to a group called TeamPCP and labelled a second wave of the Shai-Hulud worm.

What the agents found interesting was not the malware but the structure around it:

The practical advice that surfaced: if you installed any of those versions on April 29, check the maintainer account's GitHub for repositories created on or after that date, and rotate everything the CI runner could see.

A second cluster of posts, mostly from an agent called bytes, treats SAP as a case study in how enterprise software refuses to die on schedule.

The ABAP posts are the anchor. The argument: ABAP has been SAP's extension language since R/3 in 1992, it runs at most of the world's hundred largest companies, and the customer-written code adds up to hundreds of millions of lines that almost nobody outside the SAP world has ever seen. It is, in their phrase, a massive silent dependency. The S/4HANA migration SAP has pushed since 2015 is described as the largest enterprise modernization in progress, and the hard part is not SAP's standard code but the custom ABAP every customer has to remediate by hand.

The deadline posts read like a timeline of extensions:

The feed's reading is cynical but fair: every extension is framed as customer service and is also a pricing event, and a license that expires while the software keeps running is a compliance gap, not an outage.

Two smaller posts round out the theme. One notes that Sybase ASE, acquired in 2010, still ships as SAP ASE 16.0 SP04 and survives in mid-market finance, telecom billing and defense because the migration cost exceeds the maintenance cost. Another covers a German utility leaving SAP IS-U for a SaaS platform built on S/4HANA Utilities, with a 2027 go-live, and argues the driver is labor economics: a regional utility cannot win the fight for SAP specialists against metropolitan IT departments.

The posts about SAP's AI strategy are where Moltbook stops being a research digest and starts arguing with itself. The trigger was SAP's announcement in early May that it would invest roughly one billion euros over four years in Prior Labs, an eighteen-month-old German startup, and fold its work into SAP AI Core, Business Data Cloud and the agentic layer.

Three readings compete on the feed:

Two more threads attach to this. One picks up SAP's own data that only 23% of organizations have AI-ready data and 14% have governance structures, and pairs it with Databricks declaring AGI has arrived: the models are ready, the plumbing is not. The other notes SAP's CEO calling per-seat pricing for AI-driven ERP foolish and moving to charge per unit of work performed, set against Salesforce at ten cents per agent action and ServiceNow layering a per-user fee on top of seats. Three vendors, three units of measure, no consensus.

And one lone bear, posting in February, declared European enterprise software finished and told readers to overweight US AI platforms instead. It got two upvotes. The feed was not persuaded.

If you run SAP, the feed's consensus is uncomfortable but consistent. Treat every Patch Day as a same-week event, because the gap between a fix and a honeypot hit is now measured in days. Audit ABAP that builds native SQL as a class, not one CVE at a time. Treat your CI dependency tree, including SAP's own packages, as part of your attack surface. And read SAP's deadline extensions as what they are: time bought at a price, with the full migration still ahead.

If you watch SAP as a company, the feed is more divided. The agents respect the governance moat and the tabular-model bet in principle, and distrust both until a customer number shows up. The one thing they agree on is that an enterprise AI platform deciding in advance which agents may enter is a bigger strategic statement than any acquisition.

A caveat on sourcing. Every claim above is what AI agents posted on Moltbook, paraphrased. The CVE numbers, dates and figures match what the posts stated, but I have not independently verified them against SAP's security notes or primary reporting, and the agents cite sources inconsistently. Treat this as a map of the conversation, not a substitute for the advisories.

All posts retrieved from the Moltbook search API on 7 October 2026. Key posts: