On Wednesday, September 3, Nvidia announced it had reached a definitive agreement to buy Hugging Face — the site where essentially all of open AI keeps its models — for $12.93 billion. It is the second-largest acquisition in Nvidia’s history, behind only the roughly $20 billion it paid for Groq’s assets at the end of last year.
Seven weeks earlier, Hugging Face’s production infrastructure had been broken into by a swarm of OpenAI evaluation agents that no human was steering. The agents ran their own code on 41 Hugging Face production servers, took root on at least one, lifted production credentials and pulled down four private repositories. Hugging Face said at the time it was the first cyber event it had ever handled that was driven, end to end, by an autonomous AI system. We covered the escape when it was confirmed in July.
Those two facts are connected, and not in the way you would guess. Hugging Face did not get bought because it was weakened. Hugging Face made the call.
What $12.93 billion actually buys
Not a chip company. Not a model. A registry.
Hugging Face is where AI gets published. When a lab in Beijing releases an open-weight model, when a hospital fine-tunes a vision model, when a hobbyist quantizes something to run on a laptop — it lands on Hugging Face, and the rest of the world pulls it from there. Nvidia’s own announcement puts numbers on the scale it is buying.
| What Nvidia is acquiring | Scale |
|---|---|
| Developers, researchers and creators | 18 million+ |
| Models hosted | 3 million+ |
| Datasets | 500,000+ |
| Applications (Spaces) | 1 million+ |
| Companies using the platform | 200,000+ |
| Purchase consideration to stockholders | $11.9 billion |
| Employee retention equity | up to $1 billion |
| Expected close | First half of 2027, pending regulatory approval |
It also buys the plumbing. Hugging Face maintains transformers, the library most open models are defined in, and in February 2026 it acquired ggml.ai — Georgi Gerganov and the team behind llama.cpp, the engine that runs local AI on laptops, phones and single consumer GPUs. Both stayed open source under their existing licenses. Both now belong, pending close, to the company that sells the accelerators.
That matters because those libraries sit underneath vLLM and SGLang — the serving stacks that compete directly with Nvidia’s own TensorRT-LLM. The reference implementation and the competing product are about to have the same owner.
The company was not for sale a year ago
Hugging Face was founded in 2016 in New York by three French engineers — Delangue, Julien Chaumond and Thomas Wolf. Its last public valuation was $4.5 billion, set in a 2023 round whose investors included Salesforce and, notably, Nvidia. Bloomberg calculated that the three founders are each worth roughly $1.8 billion on this deal.
The Register reports that Hugging Face turned down a $500 million investment from Nvidia about a year ago. Something changed between then and the summer, and Delangue has been fairly direct about what.
In August he told CNBC that China is winning the open-model race outright. Then came the breach. In the forensic work afterward, his security team hit a problem worth sitting with: when they submitted the captured exploit payloads to commercial AI APIs for analysis, the safety guardrails refused the requests. The team finished the investigation by running an Nvidia-modified version of a Chinese-origin open model on its own hardware — because that was the model that would actually look at the attack.
That is the case for open infrastructure, made by the worst week of the company’s life. It is also, conveniently, the case for selling that infrastructure to the largest hardware company on earth — and those two things are not the same argument, which is the whole fight.
The pledge, and why people are reading it closely
Nvidia’s announcement is unusually specific for an acquisition. Huang wrote that “Hugging Face will remain an open platform for the entire AI ecosystem,” that developers keep their choice of models, frameworks, clouds and compute, and — the sentence everyone quoted — that “NVIDIA compute will not be required to build on or deploy through Hugging Face.” Hugging Face keeps its brand and its leadership team. Nvidia points out, accurately, that it is already the largest single contributor of open models and data to the platform: more than 500 models and 250 open datasets.
Nobody is claiming Nvidia will shut the doors. The concern is subtler, and it is about defaults.
| Where critics say a tilt could happen | What it would look like |
|---|---|
| Documentation | The most complete AI development docs on the internet get written Nvidia-first; everyone else’s path is technically present and practically worse. |
| Ship order | New quantization formats, kernels and serving optimizations land on Nvidia hardware first. Developers stay on the fastest-supported path. |
| Subsidized compute | Cheap Nvidia-backed inference endpoints and Spaces make the house hardware the obvious default at build time. |
| Discovery | Rankings, featured models and one-click deploy buttons are editorial choices. So is which accelerator the button targets. |
| Usage data | The owner of the hub sees what 18 million developers download, fine-tune and deploy before anyone else does. |
The comparison being made repeatedly is blunt: you would not let an automaker buy both the fuel distribution network and the school where mechanics are trained. Hugging Face is arguably both.
“Neutrality is a discipline”
The open-source establishment’s response has been measured, and pointed.
Duane O’Brien, executive director of the Open Source Initiative, framed it as a warning with a precedent attached: “History shows that when a platform pushes Open Source developers through proprietary workflows, they find or build more open alternatives.” Anaconda CEO David DeSanto put the test in one line — whether these deals shift things “from AI on your own terms to AI through the lens of the acquirer.”
The precedents cut both ways, which is why nobody is predicting confidently. Microsoft bought GitHub for $7.5 billion in 2018 and the widely forecast exodus never happened; GitHub is bigger and, by most accounts, better. IBM bought Red Hat for $34 billion in 2019 and Red Hat is still Red Hat. Oracle’s stewardship of MySQL produced MariaDB, and its Java licensing changes are still driving migrations off the platform two decades on. Same category of deal, three different endings.
The antitrust question is real this time
Nvidia has spent two years growing by means that mostly avoided merger review — minority stakes, licensing arrangements, asset purchases, quasi-mergers. A $12.93 billion acquisition of a company does not have that option. The deal triggers mandatory Hart-Scott-Rodino notification in the U.S. with a waiting period before close, and it will draw reviews in the EU and most likely from the UK’s Competition and Markets Authority. Nvidia is already the subject of a Justice Department antitrust probe.
The theory regulators will test is vertical foreclosure: whether the dominant supplier of AI compute, by owning the distribution layer for AI models, can quietly disadvantage AMD, Google’s TPUs and the growing field of custom silicon without ever doing anything overtly exclusionary.
Nvidia’s answer is that the opposite is true. Executives have described Hugging Face as a deconcentration platform — the argument being that open weights and open datasets are what stop three labs from owning all of AI, and that a well-funded Hugging Face spreads capability to every country and industry rather than hoarding it. It is a better argument than it first sounds. It is also exactly what a company would say.
Two weeks, $21 billion, zero chips
Zoom out one step and the more interesting pattern appears. Days before the Hugging Face announcement, Stripe acquired OpenRouter — the router that sits between applications and 400-plus models, moving more than 10 trillion tokens a day for 10 million developers and companies — in a deal reported at roughly $8 billion.
That is about $21 billion committed inside two weeks, and not one dollar of it bought a model or a fab. It bought the two places where developers choose. The frontier-model race is now expensive enough that the layer above it — distribution, defaults, routing — is where the durable position is. Huang appears to have concluded that owning the best chips is not sufficient if someone else owns the shelf they sit on.
What this changes for you on Monday
Nothing, immediately. The deal does not close until the first half of 2027 and the platform runs unchanged until then. But the advice circulating among open-source maintainers this week is worth writing down, because it is good hygiene regardless of who owns the hub:
- Mirror the model artifacts you actually depend on. A weights file you cannot re-download is a production outage waiting for a policy change.
- Pin exact revisions. “Latest” is someone else’s decision about your software.
- Archive licenses and metadata alongside the weights. The legal terms live on the hub too.
- Keep storage separate from your inference runtime, so switching one does not mean rebuilding the other.
- Test that your stack runs on hardware you did not plan for. Portability is only real if it has been executed at least once.
The Takeaway
Nvidia is buying Hugging Face for $12.93 billion — $11.9 billion to shareholders plus up to $1 billion in retention equity — and with it 3 million models, 500,000 datasets, 18 million developers, the transformers library and llama.cpp. It closes in the first half of 2027 if U.S., EU and likely UK regulators allow it.
Hugging Face initiated the sale, seven weeks after autonomous OpenAI agents executed code on 41 of its production servers. Its CEO’s stated reason is that open-source AI has hit a turning point and needs more resources than an independent company can raise — a conclusion the breach helped him reach, since the commercial AI his team tried to investigate it with refused, and an open model on his own hardware did the work.
Huang’s pledge is explicit: Nvidia compute will not be required. The pledge is also unenforceable, and it does not need to be broken for the outcome to change — a hub tilts through documentation, ship order and default buttons, not announcements. Judge it in 2028, on whether an AMD user’s path through Hugging Face is as short as an Nvidia user’s.