The most fundamental risk posed by agentic AI in business-critical ERP environments lies in the potential uncontrollability of autonomously operating algorithms. While traditional software operates in a strictly deterministic manner, AI agents operate probabilistically. An autonomous Joule agent that independently manages supply chains, places orders, or makes financial entries without visual oversight requires error-free, flawless master data quality and absolute system stability. An autonomous AI could procure the missing data and would stop at nothing to do so, because it has only one objective: to optimize the result based on the given prompt.<\/p>\n\n\n\n
Since these prerequisites are simply not met in the historically evolved data landscapes of most existing customers, erroneous AI decisions running in the background pose a risk of astronomical economic damage. If an AI agent, based on faulty data or a hallucination in the linked language model, concludes that a business process is inefficient and, in the worst-case scenario, arbitrarily manipulates or even deletes the ERP database, the very existence of the entire company is at stake.<\/p>\n\n\n\n
Without rigorous human oversight\u2014the absolutely essential \u201ehuman-in-the-loop\u201c or \u201ehuman-above-the-loop\u201c approach \u2014the uncritical use of such systems in the highly sensitive ERP sector is simply irresponsible, as machines cannot grasp the complex variables and the overall business context. AI systems lack understanding, but they perfectly compensate for this by \u201coptimizing\u201d the task at hand.<\/p>\n\n\n\n
When examining the technical implementation of the SAP Business AI Platform, the Knowledge Graph, and the Joule assistant, a skeptical existing AI customer encounters a highly proprietary, closed system. SAP users are presented with a black box: Access to the central Knowledge Graph\u2014which is intended to provide agents with semantic context\u2014remains exclusively restricted to SAP. Customers can neither modify the Knowledge Graph nor see in detail how the routing of the language models based on it works within the Generative AI Hub (SAP BTP).<\/p>\n\n\n\n
Even the LLM, which is typically powered by Joule, remains a mystery to customers. By requiring, through the Clean Core guidelines, that customers develop their own agents exclusively in Joule Studio on the Business Technology Platform (SAP BTP), SAP is effectively blocking traditional, flexible ABAP development at its core. This is compounded by the restrictive new API policy that SAP enacted in the spring of 2026: SAP is erecting a digital tariff barrier here and drastically restricting API usage for systematic data extraction and integration with external, generative AI systems from third-party providers.<\/p>\n\n\n\n
As a result, existing customers are artificially forced to use expensive, in-house platforms such as Datasphere or the Business Data Cloud (SAP BDC), while alternative, more flexible AI solutions from partners are systematically blocked. Furthermore, anyone who attempts to deeply integrate unstructured third-party agents into their S\/4 landscape risks completely destabilizing the painstakingly built Clean Core architecture through new technical debt and uncoordinated data flows.<\/p>\n\n\n\n
From an IT security perspective, the integration of artificial intelligence into the S\/4 environment represents an entirely new dimension of threat for which traditional frameworks are ill-prepared. Cyber resilience is vital for survival in a threat landscape that changes daily, yet SAP security is still treated as an inaccessible black box and a blind spot in many companies.<\/p>\n\n\n\n
Thanks to AI, cybercriminals operate with a high degree of automation and efficiency today. Attackers \u201enow speak ABAP\u201c and can analyze and exploit security vulnerabilities en masse in a matter of seconds. This particularly affects those business-critical core systems that, due to a lack of maintenance windows, often go unpatched for years and thus pose the highest risk.<\/p>\n\n\n\n
On top of that, traditional security tools are completely unable to detect SAP-specific threats, such as malicious code injections or manipulated file uploads via standard interfaces. According to expert reports, the BTP\u2014the linchpin of SAP\u2019s AI strategy\u2014also suffers from a glaring lack of effective governance, robust security structures, and best practices.<\/p>\n\n\n\n
The organizational separation between SAP Basis teams and the overarching IT security function leads to dangerous silos that make it extremely difficult to effectively defend against attacks. When hybrid environments consisting of on-premises systems, private clouds, and hyperscalers are combined, all transparency regarding data flows, access rights, and security statuses is lost. The only effective defense left for existing customers is therefore to establish a strict zero-trust architecture, in which\u2014in accordance with the principles of authenticity and confidentiality\u2014no user, device, or AI agent is blindly trusted\u2014even if access originates from the internal corporate network. Wherever AI attempts to achieve the optimal result, there will be a battle among IT systems.<\/p>\n\n\n\n
For an S\/4 system, these security risks intensify dramatically in the age of agents, as autonomous AI agents operate across trust boundaries (see OpenAI), make far-reaching decisions (final optimization), and process sensitive corporate data (security). Linking SAP data with external large language models (LLMs) poses a massive risk of data leaks, as customers\u2019 personal information or protected intellectual property rights could inadvertently find their way into the hyperscalers\u2019 training data.<\/p>\n\n\n\n
New regulatory requirements, such as the EU AI Act, therefore mandate comprehensive, continuous risk assessment and mandatory human oversight mechanisms for such critical AI workloads, which significantly increases the administrative burden on companies.<\/p>\n\n\n\n
How is SAP CEO Christian Klein positioning himself in light of this crisis-ridden security landscape? Internally, Klein has declared a strategic emergency (Code Red) and made AI adoption a top priority. At the same time, he is reassuring the nervous stock market and concerned customers by repeatedly emphasizing that AI will not replace existing standard software, but rather urgently needs it as a stable anchor for data quality and process logic.<\/p>\n\n\n\n
On the topic of security, SAP leadership refers to the company\u2019s own security commitment to \u201eResponsible AI\u201c and points to the SAP Trust Center. They assure customers that customer data is protected on the SAP AI Core through technical filters, data masking, and content filtering, and is not used to train third-party LLMs.<\/p>\n\n\n\n
Yet Christian Klein uses these seemingly legitimate arguments for security and stability in the same breath to push for the isolation of the SAP ecosystem. Under the guise of data protection, SAP blocks high-performance interfaces for third-party providers in order to cement commercial vendor lock-in. Just how hollow the Walldorf-based company\u2019s security promise is in a geopolitically unstable world became abundantly clear when the U.S. government blocked access to Anthropic\u2019s models\u2014Claude \u2014the cognitive brain of Joule\u2014for European users, causing the much-hyped SAP Autonomous Enterprise to suffer an embarrassing, uncontrollable meltdown overnight.<\/p>","protected":false},"excerpt":{"rendered":"
AI knows only one path: to solve a given task optimally and once and for all! What seems like a radical approach to humans is, for the machine, its logical raison d\u2019\u00eatre. Because AI has no humanistic values, it will continue to optimize until its very end.<\/p>","protected":false},"author":2,"featured_media":161236,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"pmpro_default_level":"","footnotes":""},"categories":[27840],"tags":[44122,7675,44106,44395,39847,44562,39,601,273,555,73,65,369,624,44552,43740,36985,42128,517,236,1516,44549],"coauthors":[27825],"class_list":["post-165244","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-chefredakteur-blog","tag-agentic-ai","tag-api","tag-bdc","tag-btp","tag-ccoe","tag-christan-klein","tag-cloud","tag-digitalisierung","tag-dsag","tag-ecc","tag-erp","tag-hana","tag-it","tag-ki-joule","tag-knowledge-graph","tag-llm","tag-on-prem","tag-open-source-3","tag-s4","tag-sap","tag-security","tag-soterion","pmpro-has-access"],"acf":[],"featured_image_urls_v2":{"full":["https:\/\/e3mag.com\/wp-content\/uploads\/2026\/02\/Chefredakteur-neu.jpeg",1000,450,false],"thumbnail":["https:\/\/e3mag.com\/wp-content\/uploads\/2026\/02\/Chefredakteur-neu-150x150.jpeg",150,150,true],"medium":["https:\/\/e3mag.com\/wp-content\/uploads\/2026\/02\/Chefredakteur-neu-400x180.jpeg",400,180,true],"medium_large":["https:\/\/e3mag.com\/wp-content\/uploads\/2026\/02\/Chefredakteur-neu-768x346.jpeg",768,346,true],"large":["https:\/\/e3mag.com\/wp-content\/uploads\/2026\/02\/Chefredakteur-neu.jpeg",1000,450,false],"image-100":["https:\/\/e3mag.com\/wp-content\/uploads\/2026\/02\/Chefredakteur-neu-100x45.jpeg",100,45,true],"image-480":["https:\/\/e3mag.com\/wp-content\/uploads\/2026\/02\/Chefredakteur-neu-480x216.jpeg",480,216,true],"image-640":["https:\/\/e3mag.com\/wp-content\/uploads\/2026\/02\/Chefredakteur-neu-640x288.jpeg",640,288,true],"image-720":["https:\/\/e3mag.com\/wp-content\/uploads\/2026\/02\/Chefredakteur-neu-720x324.jpeg",720,324,true],"image-960":["https:\/\/e3mag.com\/wp-content\/uploads\/2026\/02\/Chefredakteur-neu-960x432.jpeg",960,432,true],"image-1168":["https:\/\/e3mag.com\/wp-content\/uploads\/2026\/02\/Chefredakteur-neu.jpeg",1000,450,false],"image-1440":["https:\/\/e3mag.com\/wp-content\/uploads\/2026\/02\/Chefredakteur-neu.jpeg",1000,450,false],"image-1920":["https:\/\/e3mag.com\/wp-content\/uploads\/2026\/02\/Chefredakteur-neu.jpeg",1000,450,false],"1536x1536":["https:\/\/e3mag.com\/wp-content\/uploads\/2026\/02\/Chefredakteur-neu.jpeg",1000,450,false],"2048x2048":["https:\/\/e3mag.com\/wp-content\/uploads\/2026\/02\/Chefredakteur-neu.jpeg",1000,450,false],"trp-custom-language-flag":["https:\/\/e3mag.com\/wp-content\/uploads\/2026\/02\/Chefredakteur-neu-18x8.jpeg",18,8,true],"bricks_large_16x9":["https:\/\/e3mag.com\/wp-content\/uploads\/2026\/02\/Chefredakteur-neu.jpeg",1000,450,false],"bricks_large":["https:\/\/e3mag.com\/wp-content\/uploads\/2026\/02\/Chefredakteur-neu.jpeg",1000,450,false],"bricks_large_square":["https:\/\/e3mag.com\/wp-content\/uploads\/2026\/02\/Chefredakteur-neu.jpeg",1000,450,false],"bricks_medium":["https:\/\/e3mag.com\/wp-content\/uploads\/2026\/02\/Chefredakteur-neu-600x270.jpeg",600,270,true],"bricks_medium_square":["https:\/\/e3mag.com\/wp-content\/uploads\/2026\/02\/Chefredakteur-neu-600x450.jpeg",600,450,true],"profile_24":["https:\/\/e3mag.com\/wp-content\/uploads\/2026\/02\/Chefredakteur-neu-24x24.jpeg",24,24,true],"profile_48":["https:\/\/e3mag.com\/wp-content\/uploads\/2026\/02\/Chefredakteur-neu-48x48.jpeg",48,48,true],"profile_96":["https:\/\/e3mag.com\/wp-content\/uploads\/2026\/02\/Chefredakteur-neu-96x96.jpeg",96,96,true],"profile_150":["https:\/\/e3mag.com\/wp-content\/uploads\/2026\/02\/Chefredakteur-neu-150x150.jpeg",150,150,true],"profile_300":["https:\/\/e3mag.com\/wp-content\/uploads\/2026\/02\/Chefredakteur-neu-300x300.jpeg",300,300,true]},"post_excerpt_stackable_v2":"
KI kennt nur eine Richtung: Eine gestellte Aufgabe optimal und final zu l\u00f6sen! Was dem Menschen als radikaler Weg erscheint, ist f\u00fcr die Maschine ihre logische Daseinsberechtigung. Weil KI keine humanistischen Werte kennt, wird bis zum Untergang optimiert.<\/p>\n","category_list_v2":"Chefredakteur-Blog<\/a>","author_info_v2":{"name":"Peter M. F\u00e4rbinger, E3 Magazine","url":"https:\/\/e3mag.com\/en\/author\/peter-m-faerbinger-e-3-magazin\/"},"comments_num_v2":"0 comments","_links":{"self":[{"href":"https:\/\/e3mag.com\/en\/wp-json\/wp\/v2\/posts\/165244","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/e3mag.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/e3mag.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/e3mag.com\/en\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/e3mag.com\/en\/wp-json\/wp\/v2\/comments?post=165244"}],"version-history":[{"count":2,"href":"https:\/\/e3mag.com\/en\/wp-json\/wp\/v2\/posts\/165244\/revisions"}],"predecessor-version":[{"id":165252,"href":"https:\/\/e3mag.com\/en\/wp-json\/wp\/v2\/posts\/165244\/revisions\/165252"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/e3mag.com\/en\/wp-json\/wp\/v2\/media\/161236"}],"wp:attachment":[{"href":"https:\/\/e3mag.com\/en\/wp-json\/wp\/v2\/media?parent=165244"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/e3mag.com\/en\/wp-json\/wp\/v2\/categories?post=165244"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/e3mag.com\/en\/wp-json\/wp\/v2\/tags?post=165244"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/e3mag.com\/en\/wp-json\/wp\/v2\/coauthors?post=165244"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}