Segment 1: HiddenMerit Morning Post · Issue 110

Focus on Database Frontiers, Practical Insights for DBAs September 22, 2026 ｜ 5 Selected Global Breaking News

01｜China National Security Assessment Announcement No. 3 of 2026 Released: Three Centralised Databases Receive Grade I Certification, “Pass to Production Databases” Officially Issued

Recently, the China Information Security Evaluation Center released the “Security and Reliability Assessment Results Announcement (2026 No. 3).” In the centralised database category, three products each achieved Grade I security and reliability certification: Hangzhou Yijing Shutong Xihe General Database System V1.0, Huawei Cloud NetrixDB V3.0, and Tencent Cloud TDSQL Centralised Relational Database Management System V10.3.

Industry Signal: This is the first time the national assessment has issued a “pass to production databases” in the centralised database category. The lifeblood of government and enterprise core systems — ledgers, customer data, transactions, government archives — all resides in centralised databases; if the database collapses, business goes to zero. Passing this assessment means domestic centralised databases have moved from the early stage of “usable as a fallback” into the main ranks of the candidate pool for government and enterprise core systems.

DBA Perspective: The old script of “foreign databases = stable, domestic = risky” is turning the page. For DBAs, this means the selection logic for domestic databases is shifting from “can it replace” to “how do we manage it well after replacement.” The urgency for frontline DBAs is no longer “should I learn domestic databases,” but “how do I rebuild the operational systems accumulated during the Oracle era on domestic databases.”

02｜OceanBase Tops International Data Agent Benchmark: Domestic Model + Domestic Database Combination Surpasses GPT/Claude Solutions for the First Time

On September 20, the Data Agent solution Scout submitted by the OceanBase team topped the international Data Agent Benchmark (DAB), ranking first with 90.62% accuracy — the first entry to break through 90% accuracy on this benchmark.

Key Breakthrough: This result was built with a domestic database (OceanBase) + domestic large model (GLM‑5.2) combination, surpassing multiple Data Agent solutions built on overseas models including GPT, Claude Opus, and Claude Fable. The Scout solution defeated competitors using top‑tier overseas models such as Claude Opus 5 despite using GLM‑5.2 as its underlying model.

What DAB Evaluates: DAB was jointly launched by UC Berkeley EPIC Data Lab and Hasura PromptQL, covering seven major domains including internet, finance, biomedicine, and government, involving multiple databases such as PostgreSQL, MongoDB, SQLite, and DuckDB. It tests not “whether SQL can be generated,” but whether AI, upon entering a real data environment, can find the correct answer from complex, dispersed data — understanding data, planning paths, executing computation, and validating results to form a complete closed loop.

DBA Perspective: OceanBase’s top ranking on DAB means far more than “a domestic model won.” It validates a trend: in the AI era, the decisive factor in data foundation competition is not the model itself, but the collaborative capability of “model + agent + data system.” DBAs need to start understanding: your database must not only “store well,” but also “let AI use it well.”

📌 HiddenMerit In‑Depth Preview: Today’s in‑depth article – “Behind OceanBase Topping DAB: When Data Agents Become the Database’s ‘New Exam Room,’ What Should DBAs Focus On?” – will explore the technical logic of the DAB evaluation and new capability coordinates for DBAs.

03｜pg_partman Exposes High‑Risk Privilege Escalation Vulnerability (CVE-2026-61821, CVSS 8.5): Low‑Privilege Users Can Move Tables Without Authorisation

The PostgreSQL partition management extension pg_partman has been found to have a high‑risk vulnerability (CVE-2026-61821, CVSS 8.5), affecting versions before 5.5.0.

Vulnerability Details: drop_partition_id() and drop_partition_time() use part_config.retention_schema as the target for ALTER TABLE SET SCHEMA. A role with partman_user privileges can choose a target schema for which that role lacks normal CREATE privileges, and the background worker process executes the move with the privileges of pg_partman_bgw.role — which defaults to a PostgreSQL superuser — thereby bypassing authorization checks. This allows unauthorised movement of retained child tables between schemas. The vulnerability has been fixed in version 5.5.0.

DBA Perspective: The pg_partman vulnerability shares the same pattern as last week’s PostGREShell vulnerability — the background process executes operations with superuser privileges, bypassing the caller’s permission boundaries. DBAs using pg_partman should immediately upgrade to 5.5.0 and review whether the pg_partman_bgw.role configuration is appropriate.

04｜Transwarp Lists on HKEX Today: “Included in Stock Connect” on Day One, GPU‑Native Database Becomes Second Growth Curve

Transwarp (06727.HK) listed on the Main Board of the Hong Kong Stock Exchange on September 21, with an offer price of HK$49.32 per share. On its first day of trading, it was included in the Stock Connect, achieving “listing and inclusion simultaneously.”

Key Data: The company offered 14.01 million H shares globally, raising approximately HK$629 million net, with Inspur Information’s wholly‑owned subsidiary and Luoyang Science and Technology Innovation Group as cornerstone investors. As of March 31, 2026, its products have been deployed across more than ten industries, serving over 1,800 customers, including 105 Fortune China 500 companies, with repeat purchase revenue from existing customers averaging over 70% of total revenue. H1 2026 core business revenue was RMB 174 million, up 14.1% year‑on‑year.

GPU‑Native Cognitive Database: The company is advancing its second product curve. The GPU‑native cognitive database preview released in July 2026 achieved a 26x performance improvement over CPU instances in a 150GB TPC‑DS benchmark, with an ROI of 5.9x. The company plans to establish benchmark customers in 2026, enter a large‑scale expansion phase in 2027, and launch a cloud version in the second half of 2026.

DBA Perspective: Transwarp’s listing is a landmark event marking the transition of GPU‑native databases from “technical validation” to “capital market recognition.” For DBAs, this means the hardware foundation of databases is undergoing structural change — tuning dimensions will expand from CPU cores, memory, and disk I/O to GPU video memory management, parallel stream scheduling, and data residency strategies.

05｜CETC Kingware Selected for First Batch of National Emerging Industry Development Demonstration Bases: Only Four Software Companies Recognised

Recently, the Ministry of Industry and Information Technology officially announced the first batch of national emerging industry development demonstration base creation targets. CETC Kingware was successfully selected for its core technology breakthroughs, industry leadership, and ecosystem driving effects in the database field, becoming one of the first four demonstration enterprises recognised in the software sector.

Key Data: CETC Kingware was founded in 1999, making it the earliest domestic database company with independent intellectual property rights, and a member enterprise of China Electronics Technology Group. Two products across three versions have passed the “Security and Reliability Assessment.” In 2026, it became the first company in the industry to pass the converged database authoritative test, obtaining the highest level Grade 3 certification for software supply chain security capability. Cumulative installations exceed 1.1 million sets. In 2026, it ranked first in database sales in the power generation industry, maintained the top position in domestic database critical application sales share for six consecutive years, and ranked first in healthcare industry sales for three consecutive years.

DBA Perspective: Kingware’s selection as a national‑level demonstration base validates the comprehensive strength of leading domestic database vendors in “product development, technological innovation, and business model innovation.” For DBAs, this means that in Xinchuang selection, leading vendors’ “national‑level certifications” are becoming an important reference dimension for evaluating their long‑term technology roadmap and ecosystem stability.

💡 SQL Little Knowledge Point

This Issue’s Knowledge Point: What is the Data Agent Benchmark (DAB)?

DAB (Data Agent Benchmark) was jointly launched by UC Berkeley EPIC Data Lab and Hasura PromptQL, and is one of the most authoritative international evaluation benchmarks in the data agent field today.

Dimension	Traditional Text‑to‑SQL	DAB
Evaluation Goal	Can correct SQL be generated	Can the answer be found from real data
Task Complexity	Single‑turn query	Multi‑step planning + execution + validation
Data Environment	Single database	Multiple databases + heterogeneous data sources
Core Capability	Syntax conversion	Data understanding + path planning + result verification

DAB’s Evaluation Logic: In a complete task, a Data Agent needs to: understand the data (identify fields and data relationships) → plan the path (choose execution strategy based on task complexity) → execute computation (data selection, filtering, joining, computation) → validate results (check the computation process through evidence tracking and answer verification). This forms a complete closed loop of “data understanding — planning execution — validation and repair.”

Implications for DBAs: When AI agents become the new consumers of data, the database’s “assessment criteria” are expanding from “query performance” to “can it support agents in completing end‑to‑end analytical tasks.” DBAs need to start understanding agents’ data access patterns — not “finding the answer to a known question,” but “exploring the context of an unknown question.”

HiddenMerit Team Production Slogan: 绩优隐于内，金石启新程 | Hidden deep. Merit bold. Forge ahead.

Segment 2: HiddenMerit In‑Depth · Issue 23

Focus on Database Frontiers, In‑Depth Analysis September 22, 2026 ｜ 1 In‑Depth Feature Article

Behind OceanBase Topping DAB: When Data Agents Become the Database’s “New Exam Room,” What Should DBAs Focus On?

1. A “Purely Domestic Combination” Defeated GPT and Claude

What makes this result truly intriguing is its “composition”: domestic database OceanBase + domestic large model GLM‑5.2. Behind it are multiple Data Agent solutions built on top‑tier overseas models including GPT, Claude Opus 5, and Claude Fable 5. Despite its underlying model not being the “strongest,” OceanBase’s Scout solution ultimately surpassed competitors including Claude Opus 5 (87.9%).

This is not a simple narrative of “a domestic model won.” It points to a deeper proposition: when AI agents become the new users of databases, the database’s “assessment criteria” are being redefined.

2. What Does DAB Test?

To understand the significance of OceanBase’s top ranking, one must first understand the essential difference between DAB and previous evaluations.

[quads id="805"]

Traditional Text‑to‑SQL (such as BIRD, Spider) tests “whether natural language can be converted into correct SQL.” This is a single‑turn task: input a question, output a SQL statement, compare results after execution.

DAB tests “whether the correct answer can be found from real data.” In a complete task, a Data Agent needs to:

Understand the data: Identify available fields, understand data relationships, assess data quality.
Plan the path: Based on task complexity, decide what to query first, what next, and how to join.
Execute computation: Complete data selection, filtering, joining, and aggregation.
Validate results: Check whether the computation process is reasonable and results are reliable, adjusting the approach and re‑validating when issues are found.

DAB was jointly launched by UC Berkeley EPIC Data Lab and Hasura PromptQL, covering domains including internet/local life, finance and stocks, biomedicine, intellectual property, enterprise operations, government/public administration, and media/entertainment, involving multiple databases such as PostgreSQL, MongoDB, SQLite, and DuckDB.

This means DAB tests not just the underlying model, but the comprehensive capability of “model + agent + data system.” The model handles understanding and reasoning, the agent handles planning and execution, and the data system must support data discovery, join computation, and result verification. Whether the three can collaborate directly determines whether AI can truly put enterprise data to use.

3. What Did OceanBase Get Right?

OceanBase’s Scout solution is built precisely around the collaborative capability of “model + agent + data system.”

Layer 1: Data profiling (DataLens) . The system first builds a data profile, identifying fields and data relationships. This is equivalent to letting the agent “first understand what the data looks like,” rather than blindly generating SQL.

Layer 2: Task planning and execution. Plan the execution path based on task complexity, completing data selection, filtering, joining, and computation. This is equivalent to letting the agent “think clearly about how to do it,” rather than “doing while thinking.”

Layer 3: Result validation and repair. After obtaining results, check the computation process and results through evidence tracking and answer verification, adjusting the approach and re‑validating when issues are found. This forms a complete closed loop of “data understanding — planning execution — validation and repair.”

Key Difference: OceanBase’s solution is not “throw the problem at the model and let it generate SQL,” but rather provides support capabilities for data understanding, path planning, and result validation at the data system level. The model handles reasoning, but the data system ensures “reasoning has evidence to rely on.”

4. What Does This Mean for DBAs?

OceanBase topping DAB offers implications for DBAs that go far beyond the conclusion that “domestic databases have strong AI capabilities.”

Implication 1: The database’s “assessment criteria” are expanding from “performance” to “agent support capability”

In the past, the core metrics DBAs used to evaluate databases were TPS, QPS, latency, and availability. In the future, a new dimension is emerging: can this database support AI agents in completing end‑to‑end analytical tasks? This includes: data profiling capability, schema discovery capability, query path planning support, and result validation mechanisms.

Implication 2: DBAs need to understand the working mode of “Data Agents”

A Data Agent is not a “smarter Text‑to‑SQL.” Its working mode is: explore data → plan path → execute analysis → validate results. This requires the database not only to “respond to queries,” but also to “assist exploration.” DBAs need to start thinking: does my database provide sufficient data discovery capability? Is the schema information agent‑friendly? Is there sufficient statistical information to support query path planning?

Implication 3: Domestic databases’ AI capabilities are moving from “concept” to “verifiable”

In the past, domestic databases’ AI capabilities often remained at the functional level of “supporting vector retrieval” or “built‑in AI functions.” OceanBase topping DAB is the first time domestic databases’ AI capabilities have been validated for “end‑to‑end task completion capability” in an internationally authoritative evaluation. For DBAs, this means there is now a more robust quantitative reference for evaluating domestic databases.

5. The Bigger Picture

OceanBase topping DAB validates a trend that is already happening: databases are moving from “the data foundation for AI” to “the data work engine for AI.”

In the past, the database’s role was “store data well, compute it well, retrieve it.” Now, databases need to help AI understand data, organise data, and complete analysis. From “handing data to AI” to “helping AI put data to use” — this is not just a change in product form, but a redefinition of the relationship between databases and AI.

For DBAs, this means a new capability coordinate system needs to be established: no longer using “SQL optimisation capability” as the sole core skill, but starting to understand “how to make databases better support agents’ exploratory data access.” This includes: building data profiles, making schema design agent‑friendly, ensuring completeness of statistical information, and supporting query path planning.

When Data Agents become the database’s “new exam room,” the DBA’s “study direction” also needs to be updated accordingly.