Is SUID status for at disabled?
"at" is used for scheduling an individual task to run at a single later time. There have historically been many exploits that take advantage of weaknesses in "at". Virtually all of the necessary functionality of "at" can be found in cron (and removing cron is not practical) so there is no need to retain privileged access for "at".