AI and cloud briefing: a maximum-severity Metabase flaw hits customer data, plus Google reshuffles its AI leadership

Here is our latest round-up of what matters in AI and cloud for UK businesses. It is short and factual, with links to credible sources so you can read further.

Lead story: a maximum-severity Metabase zero-day exposes customer data

Metabase, a widely used open-source analytics and dashboard tool, has confirmed that attackers exploited a previously unknown flaw in its unauthenticated password-reset endpoint to inject SQL commands and gain full admin access without any credentials. The flaw, tracked as GHSA-vwf4-m7j8-wcjf, carries the maximum CVSS score of 10.0 and affects self-hosted and cloud deployments from version 1.58 onward. Metabase’s own Cloud platform was breached from around 3 August 2026, and the company shipped a patch within hours once the abuse was detected. Two companies, Framework and Tally, have since disclosed that customer names, addresses, phone numbers and emails were accessed through the flaw. Further detail is available from The Hacker News and Security Affairs.

What is significance: Metabase sits in front of company databases at thousands of organisations, so a flaw that grants unauthenticated admin access is serious well beyond the two companies that have gone public so far. It is also a reminder that business intelligence and dashboard tools, not just email and file-sharing systems, hold sensitive data and need the same patching discipline.

Our advice: if you or a supplier runs self-hosted Metabase, update immediately to a patched release, review database credentials stored in Metabase for rotation, and check access logs for the reset-password endpoint for signs of misuse.

AI industry: Google reshuffles its AI leadership as the race with OpenAI and Anthropic heats up

Google is concentrating its AI leadership in California, with DeepMind co-founder Demis Hassabis stepping back from day-to-day running of Google DeepMind to become chairman and take on a new role as Alphabet’s chief scientist. Koray Kavukcuoglu, previously DeepMind’s chief technology officer, takes over daily operations, including Gemini development, as senior vice president. Separately, long-time Google AI figure Jeff Dean is leaving to start his own company, taking some colleagues with him. Coverage is available from Axios and Startup Fortune.

What is significance: leadership changes at this level signal how seriously Google is treating competition from OpenAI and Anthropic. For businesses using Gemini or Google Cloud AI tools, a change in day-to-day leadership is worth watching for shifts in product priorities and release pace over the coming months, though no immediate changes to existing products have been announced.

Cloud: Microsoft Azure crosses $100 billion in annual revenue

Microsoft’s fiscal year 2026 results, covering the year to 30 June, show Azure and other cloud services revenue passed $100 billion for the first time, growing 41% for the full year and 43% in the final quarter. This follows earlier reporting this year of Google Cloud’s 82% quarterly growth and the joint AWS-Google multicloud initiative we covered on 7 August. Coverage is available from Fortune and Fierce Network.

What is significance: all three major cloud providers are now reporting strong double-digit or higher growth, largely driven by AI workloads. For businesses, this scale of investment usually means faster feature releases and more competitive pricing, but it is also worth checking that your cloud contracts and reserved-capacity commitments still reflect current pricing rather than rates agreed a year or more ago.

Also in AI: Alibaba releases an image model built for readable text, not just art

Alibaba’s Qwen team has released Qwen-Image-3.0, an image-generation model aimed at producing usable working documents rather than decorative pictures. It can take text input of up to 4,500 tokens and generate infographics, diagrams, formulas and multi-layer UI mockups with legible small text in a single pass, and it supports more than a dozen languages. Unlike earlier versions, Alibaba has not published benchmark scores, a model card or a technical report alongside the release, and access is currently invite-only through the API. Further detail is available from Unite.AI.

What is significance: image models that can reliably render small, correct text have practical uses for things like slide graphics, product mockups and diagrams, tasks earlier models often got wrong. The lack of published benchmarks makes it hard to independently verify Alibaba’s claims for now, so treat early reports with some caution until wider testing is available.

The takeaway

Four stories, one thread: growth and consolidation in AI and cloud are moving alongside a steady stream of security incidents. A maximum-severity flaw in a widely used analytics tool has already led to real data breaches, while Google’s leadership reshuffle and Microsoft’s cloud milestone show how much investment and competitive pressure is building around AI infrastructure. Businesses should keep patching cycles tight for the tools that sit closest to their data, including dashboards and BI platforms, and periodically review cloud contracts and AI vendor choices rather than leaving them unexamined for a year at a time. If you would like help reviewing your patching process or your cloud and AI vendor strategy, get in touch.

AI Agent based research and content, AI can do mistake, please help us to improve.