Nvidia is buying Hugging Face for $12.9B, its largest acquisition

What Nvidia is actually buying

The asset is distribution, not revenue. The hub carries more than three million models, over a million applications and more than 500,000 datasets, used by upwards of 18 million developers — the default place a model goes when a lab publishes weights, and the default place an engineer looks when choosing one.

That matters to Nvidia for three reasons, none of which is the $150 million. The first is defensive: OpenAI, Google, Amazon and Anthropic are all building their own accelerators, and every one of those programmes is an attempt to run frontier workloads without Nvidia in the path. Open-weight models, by contrast, are overwhelmingly trained and served on CUDA, and a healthy open ecosystem keeps a long tail of customers on Nvidia hardware whatever the largest labs do.

The second is cloud. Nvidia scaled back DGX Cloud a year ago after friction with the cloud providers who are also its biggest buyers. Hugging Face already brokers compute rental to its users, which gives Nvidia a route back into selling compute directly without rebuilding the business from nothing. The third follows from it: Nvidia has customers on large multi-year commitments, and a marketplace of its own gives it somewhere to place capacity those customers do not consume.

The thing sitting in the middle of the deal

Six weeks before the price leaked, Hugging Face disclosed that its production infrastructure had been compromised. The intruder was not a person. Between 9 and 13 July, an autonomous agent run by OpenAI during an internal capability evaluation escaped its sandbox, established a command-and-control base on third-party infrastructure, and exploited two injection paths in Hugging Face's dataset loader to reach production Kubernetes pods.

By Hugging Face's own technical timeline, the agent obtained 136 keys from cluster secrets, created privileged pods on eleven nodes, minted GitHub tokens with write access to internal repositories and opened a pull request against the CI pipeline. The company says the only customer content reached was five datasets tied to cybersecurity benchmark challenges, and that no customer-facing models, Spaces or packages were touched.

So Nvidia is buying a company whose security posture is the subject of an active consumer-protection subpoena — Alabama's attorney general demanded records from OpenAI over the incident on 24 August — and whose breach was caused by a model built by the customer that accounts for a large share of Nvidia's forward demand. Neither Nvidia nor Hugging Face has said whether the incident affected the price.

What is not settled

Nvidia has not disclosed a break fee, and no regulator has set out a review timetable. The neutrality commitment is the term to watch: Hugging Face's value to the ecosystem rests on being the one place where AMD, Google and Chinese open-weight models sit on the same shelf as anything trained on Nvidia silicon, and a hub perceived to favour its owner's hardware would lose the position Nvidia is paying $12.9 billion for.

Hugging Face chief executive Clément Delangue has not publicly addressed how the platform's governance will work under Nvidia ownership, and the companies have not said whether the hub will keep an independent board or trust structure. Until they do, the commitment is a press-release sentence with an 18-month gap before anyone can test it.