Nvidia Bought Hugging Face for $12.93 Billion. Your Pipeline Still Asks It for a Branch Name.
Nvidia made the deal definitive on 3 September: $12.93 billion for Hugging Face, roughly $11.9 billion in cash plus about $1 billion in equity to keep staff, with closing expected in the first half of next year. Jensen Huang said the Hub stays open and that Nvidia compute will not be required to build or deploy on it.
Take that promise at face value and almost nothing changes for you, because ownership was never the exposure. The exposure is that from_pretrained("org/model") resolves a mutable branch name at call time, and most production code never passes a revision at all.
Branches move. Tags move. Only the full commit hash is a pin. huggingface_hub 1.30.0 shipped resolve_revision() to make pinning cheap, Bandit has flagged the unpinned call since 1.8.6, and hf cache verify will tell you whether what is on disk still matches the Hub.
Nvidia confirmed on 3 September that it is buying Hugging Face for $12.93 billion. The structure is about $11.9 billion in cash to shareholders and up to $1 billion in equity to retain employees joining Nvidia, with the close expected in the first half of next year. It is Nvidia's second largest purchase, behind the roughly $20 billion it paid for Groq's assets at the end of last year, and it lands on a platform carrying 3 million models, 500,000 datasets, 1 million applications and 18 million registered developers against $150 million in annualised revenue.
Huang's line was a neutrality pledge: developers keep choosing their models, frameworks, clouds and inference providers, and Nvidia compute will not be required. Hugging Face turned down a $500 million Nvidia offer last year, so the price tells you how the registry layer is now valued relative to the models sitting in it.
Assume the pledge holds completely. The Hub stays open, nothing gets paywalled, no weights move behind a CUDA gate. You still have a problem, and you had it last month too. The acquisition is just the first thing in a while that made anyone look at the dependency.
Your code asks for a name, not a version
The revision argument is optional on every function that pulls from the Hub. hf_hub_download, snapshot_download, load_dataset, and every from_pretrained wrapper in transformers accept it, and every one of them defaults to the repository's default branch when you leave it out.
That default is not a version. It is a lookup. The Hub's cache layout makes the mechanism visible: each cached repo has a refs/ folder containing a file named main whose entire contents are the commit identifier of the current head. Push a new commit to the repo and the next download rewrites that file to the new identifier. The name you asked for stayed the same. The bytes did not.
So this line, which is in a great many Dockerfile builds and CI jobs right now:
model = AutoModel.from_pretrained("org/model-name")
is not a request for a specific model. It is a request for whatever that repository's maintainer last pushed, evaluated at the moment your container builds, or your pod cold starts, or your batch job retries.
The library's own documentation is blunt about the sharp edge here. When a loader pulls config, weights, tokenizer and processor as separate calls, each call resolves main again, and two calls made seconds apart can land on two different commits if the repo is updated in between. That is not a hypothetical attack. That is a normal Tuesday for a maintainer pushing a fix.
A tag is not a pin either
The common half measure is to reach for a tag, on the assumption that v1.0.0 means something. It does not. On the Hub, a tag is a git ref like any other, and refs are movable. Nothing prevents a maintainer, or anyone who takes over that account, from repointing v1.0.0 at different content next week.
The only immutable identifier in the system is the commit hash, and it has to be the full one. Bandit encodes exactly this. Rule B615, huggingface_unsafe_download, added in version 1.8.6, flags AutoModel.from_pretrained, AutoTokenizer.from_pretrained, load_dataset, hf_hub_download and snapshot_download when they are called without a commit-based revision. Medium severity, high confidence, mapped to CWE-494, download of code without integrity check. The rule has been sitting there for a while. It only helps if you actually run Bandit over the code that loads models, which for most teams means the ML directory nobody put in the security pipeline.
huggingface_hub 1.30.0 made the fix ergonomic. resolve_revision() turns a branch name into a commit hash once and hands back a ResolvedRevision, which subclasses str so it drops into any call that takes a revision:
from huggingface_hub import resolve_revision, hf_hub_download
revision = resolve_revision("openai-community/gpt2")
revision.resolved
# '607a30d783dfa663caf39e06633721c8d4cfcd7e'
config = hf_hub_download("openai-community/gpt2", "config.json", revision=revision)
weights = hf_hub_download("openai-community/gpt2", "model.safetensors", revision=revision)
Every file now comes from the same commit. The mapping is written into the cache's refs/ folder, so if the Hub is unreachable later the resolution falls back to the cached value instead of failing or, worse, quietly drifting.
The guard you thought you had
If your response so far is that you set trust_remote_code=False and moved on, that control failed in public this year. CVE-2026-4372, disclosed by Pluto Security, let an attacker put a crafted value in a model's configuration file that caused code to execute on a routine from_pretrained() call with trust_remote_code=False still set. No warning, no prompt. It affected every release from 4.56.0 onward on systems with the kernels package installed, and was patched quietly in Transformers 5.3.0 before the disclosure. The fix blocked attacker-controlled configuration values and required explicit consent before loading external kernels.
Safetensors helps with a different part of this. Hugging Face contributed the format to the PyTorch Foundation in April, and it does remove the pickle deserialisation class of remote code execution. It says nothing about which bytes you received. A malicious safetensors file is still a malicious file, delivered safely.
Cryptographic provenance is not the escape hatch yet. Hugging Face does sign commits, but it does not expose users' public keys, so verifying a signature yourself is not a workflow you can build a gate on today. The Linux Foundation's model signing work and Sigstore integrations are moving, and they are not where your pipeline is. Until they are, the commit hash is the strongest identity claim you can actually check.
The four things worth doing this week
Resolve every model reference to a full commit hash and store the hashes in a file you commit, the same way you treat a lockfile. Then make the absence of a revision a build failure. That lint rule is one line and it is the highest value hour on this list, because it stops the next unpinned reference from being added while you clean up the current ones.
Grep for trust_remote_code=True and treat every hit as a code path where a compromised upstream repository runs your credentials. Some models genuinely require it. Those get a pinned commit and a human who read the modelling file, not a default.
Run hf cache verify against the revisions you actually serve. It checks the cached files against the Hub's checksums and tells you plainly whether they match, which is the cheapest way to find out that a machine somewhere is running weights nobody can account for.
And if you have a small number of models that carry real revenue, mirror them into storage you control, pinned by hash. Not because Nvidia will close the Hub, they almost certainly will not, but because availability and integrity are different properties and pinning only buys you one of them.
The acquisition is going to take most of a year to clear. That is a year of every unpinned build in your estate resolving a branch name against a registry whose governance is mid-transition. Nothing about that resolution changed on 3 September. The only thing that changed is that you noticed it.