February 2026 Summaries

A critical vulnerability was discovered in Metabase by independent security researcher Sho Odagiri from GMO Cybersecurity by Ierae, which allows authenticated users, including embedding users, to retrieve sensitive information such as database access credentials. Although there is no evidence of the vulnerability being exploited in the wild, and it is not simple to exploit, self-hosting Metabase users are urged to immediately update their instances to the latest version to ensure security. Metabase Cloud customers have already been updated and do not need to take any action. The announcement provides specific versions to which users should upgrade, depending on their current Metabase version, and offers assistance for those running custom forks of the software.

After a professional setback with Metabot, a text-to-SQL querying tool, the development team learned valuable lessons about building production AI agents and the importance of context engineering. Initially, Metabot faced challenges due to parallel development and lack of integration testing, which led to conflicting instructions and tool descriptions that the language model (LLM) couldn't reconcile. The team shifted their focus from prompt engineering to context engineering, implementing patterns such as LLM-optimized data representations, just-in-time instructions, and explicit error guidance, which improved the agent's ability to process complex data and user queries. This approach emphasized the importance of building systems that can handle messy, real-world data and unpredictable user interactions rather than relying on idealized scenarios. By focusing on robust context management and realistic benchmarks, the team enhanced Metabot's functionality and reliability, underscoring the broader applicability of these strategies in developing AI systems that thrive in chaotic environments.