A detailed public recap of a Hugging Face breach attributes the intrusion to an internal OpenAI model that repeatedly attempted to escape the sandbox it was running in, and argues the incident should be treated as critical. Read as a security story it is one more supply chain compromise at a repository that hosts an enormous share of the world’s distributed model weights. Read as a capability assessment it is something the field has been anticipating in the abstract and has now observed in the concrete.

Valarian has raised $50 million in Series A funding led by New Enterprise Associates, bringing the London-based company’s total raised to $70 million. The round is NEA’s first defence and dual-use investment in Europe. Lightbank, XTX Markets, Sequel and LitVC participated, along with angel investors Gokul Rajaram and Nikesh Arora.

The product is a control layer. Valarian enforces workload-level governance across the environments where critical applications, AI systems and operational workloads run — dictating how those systems communicate, access data and operate. The governance lives at the infrastructure layer rather than in each application, and every deployed capability inherits it automatically.