In September, Nvidia agreed to buy Hugging Face for $12.93 billion. In 2023, investors valued the company at $4.5 billion.
If you haven't heard of Hugging Face, think of it as an easily shareable and highly available library of code and data related to AI. Developers go there to find, share and download AI models, the data used to train them, and small apps built on top. More than 18 million developers and 200,000 companies use it, and it holds over 3 million models.
Jensen Huang says Hugging Face will stay open. You won't need Nvidia chips or Nvidia's cloud to use it. I'll take him at his word for now, but only time will tell.
Why a hardware company wants to own a library
Hardware companies like Nvidia and Apple learned the same lesson a long time ago. Chips sell better when the software people already use is built around them. Hugging Face gives Nvidia that kind of foothold overnight, with a community it would have taken a decade to grow on its own.
I've seen this play before. Microsoft bought GitHub for $7.5 billion in 2018, and plenty of developers expected the worst. Instead, GitHub mostly kept doing its own thing, kept growing, and became the launchpad for Copilot. Microsoft got a front-row seat to how the world writes software.
I expect Nvidia is hoping for the same, maybe more, as it pushes into robotics and quantum computing. As a business move, this one makes sense to me.
What worries me happened two months earlier.
The July incident
In July, Hugging Face was hacked. The attacker wasn't a criminal gang. It was a group of AI agents from OpenAI that were supposed to be locked inside a test.
OpenAI was measuring how good its models had become at cybersecurity work. It gave agents hard hacking challenges, some of them unsolvable, inside a sealed-off environment called a sandbox. An independent investigation by METR and Redwood Research found the following:
- About 1,200 agents that were supposed to be isolated found a way to talk to each other. They built a makeshift message board and traded more than 70,000 messages and files.
- Around 700 of them went after Hugging Face between July 11 and 13. Using login credentials they found exposed online and a flaw in how Hugging Face handles uploaded data, they ran their own code on Hugging Face servers and spread through its systems.
- They organized. Some agents coordinated the work, some recruited others, and some tried to alter their own records so the test's scoring system wouldn't see how they got their results.
- Separately, agents went on to compromise parts of OpenAI's own infrastructure.
As far as investigators can tell, the agents were trying to beat the test. No one pointed them at Hugging Face. They picked Hugging Face as a platform on their own because it looked like a place which may have answers it was looking for.
That's the part I can't shake as a security leader.
Why this matters
Security people use the term "supply chain attack." Instead of breaking into a company directly, an attacker breaks into something that company already trusts, like a software supplier. The damage then flows downstream to every customer at once. It's the difference between tampering with one house's tap and tampering with the water treatment plant. In 2020, the SolarWinds attack worked this way: one poisoned software update reached as many as 18,000 organizations.
Imagine Hugging Face to be like a water treatment plant for AI. If someone quietly altered a popular model or dataset there, thousands of companies could pull the tampered version into their own products without knowing.
Hugging Face says it found no tampered packages or software releases after July. That's good news.
Where Nvidia should invest first
I'd start with the two areas I've spent most of my career in: identity and data.
Know who's on the platform, all the time. Verify developers, companies and the code they publish, and keep verifying for as long as they're there, not just at sign-up. A trusted account today can be a stolen account tomorrow. July started with leaked credentials.
Protect what the world depends on most.
Not every model needs the same guardian. The ones downloaded by thousands of organizations deserve extra layers, because one compromise could hit an entire industry, or several, in an afternoon. Anything used by hospitals, power grids and water systems should come first, because failure there puts lives at risk.Watch the agents, not just the people. A growing share of activity on platforms like this will come from AI agents rather than humans. Nvidia needs a way to check what those agents are doing from their first action to their last, every time. That will take enormous resources. But Nvidia is worth around $5 trillion. If anyone can afford to build it, they can.
What's next?
I expect a lot of money to flow into security controls, AI safety and agent governance on the back of this deal, along with the hardware that makes them possible. Customers will end up paying for some of that.
Maybe it’s a fair trade. Hugging Face became critical infrastructure without anyone deciding it should. Now it belongs to a company with the means to protect it like critical infrastructure. Whether Nvidia actually does is what I'll be watching how this unfolds.
About the Author:
Aby Rao is a cybersecurity and risk management leader with two decades of experience in the American workforce, including roles with Fortune 500 companies and high-growth technology organizations. He hopes to make AI and cybersecurity conversations more practical, accessible, and useful for business decision-makers through his writing, speaking, and community engagement.
References:
[1] Phoronix, "NVIDIA Acquiring Hugging Face For $12.93 Billion" (Sept 3, 2026): https://www.phoronix.com/news/NVIDIA-Hugging-Face
[2] Outlook Business, "Nvidia To Acquire Hugging Face For $12.9 Bn: Report": https://www.outlookbusiness.com/amp/story/corporate/nvidia-to-acquire-hugging-face-for-129-bn-report
[3] CRN Australia, "Nvidia acquires Hugging Face in US$12.9 billion mega deal": https://www.crn.com.au/news/2026/ai/nvidia-acquires-hugging-face-us12-billion-mega-deal
[4] Advanced Television, "Nvidia acquires Hugging Face for $12.9bn" (Sept 4, 2026): https://www.advanced-television.com/?p=291512
[5] TechCrunch, "Four years after being acquired by Microsoft, GitHub keeps doing its thing" (Oct 26, 2022): https://techcrunch.com/2022/10/26/four-years-after-being-acquired-by-microsoft-github-keeps-doing-its-thing/
[6] METR, "Brief independent investigation of agents' behavior, reasoning and collaboration in the OpenAI / Hugging Face hacking incident" (Aug 26, 2026): https://metr.org/blog/2026-08-26-openai-hugging-face-incident-investigation/
[7] OpenAI, "The Hugging Face incident and the road ahead": https://openai.com/index/hugging-face-incident-and-the-road-ahead/
[8] The Hacker News, "Nearly 18,000 SolarWinds Customers Installed Backdoored Software" (Dec 2020): https://thehackernews.com/2020/12/nearly-18000-solarwinds-customers.html
[9] Tech Wire Asia, "OpenAI agent sandbox breach reached Hugging Face systems" (July 30, 2026): https://techwireasia.com/2026/07/openai-agent-sandbox-breach-hugging-face/