Hugging Face: 13 billion dollars for the choke point of global AI

What the valuation, the July 2026 intrusion and 2.96 million repositories tell us about the real solidity of your AI supply chain

Special report. By Patrick de Carvalho, CEO and co-founder of Apps Velocity.

---

In short: Hugging Face hosts close to 3 million artificial intelligence models and acts as the passage point for a large share of global AI. In August 2026 the platform is exploring a sale valued at a minimum of 13 billion dollars, one month after suffering an intrusion that lasted several days. The question for a company director is not what the platform is worth, but what they would lose if it changed hands, and how long it would take them to replace it.

---

Opening: the lesson of 1998

In 1998 I launched planetepresse.com, one of the very first e-commerce sites in the world. We sold single issues and subscriptions to printed magazines, at a time when most people had not yet worked out what a web browser was for.

The model, with hindsight, was an ancestor of dropshipping. I collected the orders and the payments, the publishers shipped the magazines directly to the customers. We had our own servers and a network and systems administrator. Nothing we were doing existed anywhere else.

Every morning at five o'clock, an automated feed pulled in the database of magazine cover images from an outside partner. It was an invisible operation, running while everyone slept, and one that nobody in the company ever thought about.

Until the mornings when it did not run.

When the feed went down, the site worked perfectly. The pages displayed, the basket worked, the payments went through. The covers were simply missing. A magazine catalogue without cover images is, from the customer's point of view, a list of titles.

We had measured the effect of the cover image on purchase intent. It was in the order of 74%. Without the covers we sold almost nothing, while nothing on our side was broken.

That is where I understood something that thirty years of tech entrepreneurship have only confirmed. My most expensive dependency was not the one I was watching. I was watching my servers, my network, my database. What could cut off my revenue overnight was an automated five o'clock task I had never once mentioned in a meeting.

You never measure your dependency on a supplier until the day that supplier has a problem. The rest of the time it is invisible. It is even comfortable. That is exactly what makes it dangerous.

I often think back to those 1998 mornings when I look at what is happening around Hugging Face today.

Because in August 2026, a company founded by three Frenchmen is exploring a sale at more than 13 billion dollars. Because in July 2026, that same company was attacked for four and a half days by an autonomous artificial intelligence agent that was cheating on its own exam. And because, in both cases, the vast majority of directors of small and mid-sized companies using AI today do not know that this platform sits somewhere inside their technical chain.

This report exists to close that gap. It is not aimed at engineers, who already know the subject. It is aimed at the directors who sign the budgets, carry the legal risk and answer to their clients when something breaks.

---

Act 1: what Hugging Face actually is

Let us start at the beginning, because the name raises a smile and the smile often gets in the way of understanding what is at stake.

Hugging Face was founded in 2016 in New York by three French entrepreneurs: Clément Delangue, Julien Chaumond and Thomas Wolf. The initial project was a chatbot for teenagers, meaning a conversational agent designed to talk with young people. That product did not work. The founders then opened up the code of the technical building block that powered it, and it is that building block, not the product, that built the company.

Today Hugging Face is what is called a Hub, a central point where you deposit and retrieve artificial intelligence components. Three types of component mainly:

• Models, meaning systems that have already been trained and that you can download and use without starting from scratch. The right word is weights, because a trained model is nothing more than a very large file of numbers.
• Datasets, the collections of examples used to train or evaluate those models.
• Spaces, small demonstration applications that run a model directly in the browser.

Hugging Face is commonly nicknamed "the GitHub of AI". The shorthand is useful: GitHub is where the whole world stores and shares source code. Hugging Face is where the whole world stores and shares AI models.

The orders of magnitude, published by the platform itself in its August 2026 report, are dizzying. Between January and August 2026, public model repositories went from 2.43 to 2.96 million. Datasets from 711,000 to 1 million. Spaces from 1 million to 1.44 million. A repository, here, is the equivalent of a shared folder containing a component and its documentation.

But the figure that matters is not that one. Here it is: 1.5% of repositories account for 99.2% of all downloads, and 85.6% of models total fewer than 200 downloads over their entire lifetime.

In other words, those three million models do not form a market. They form an immense library whose shelves almost nobody consults, plus a handful of volumes the whole world borrows every day. Remember that shape. We will come back to it, because it explains just about everything else.

---

Act 2: why 13 billion dollars

On 23 August 2026, Business Insider revealed that Hugging Face is exploring a sale at a valuation of at least 13 billion dollars, and that a bank has been mandated to sound out the interest of potential acquirers. No deal has been concluded to date. No buyer's name has leaked.

Let us put that figure in perspective. The company's last funding round, a 235 million dollar Series D led by Salesforce Ventures in 2023, valued it at 4.5 billion. Thirteen billion is therefore around 2.9 times that value, in three years.

And on the revenue side? Clément Delangue confirmed in July 2026 that he had passed 100 million dollars of ARR. ARR, for Annual Recurring Revenue, means annualised recurring revenue, in other words what subscriptions bring in over twelve months. The research firm Sacra estimated that figure at around 150 million in August 2026. Delangue also stated that he was "close to profitability" and had only recently started spending the funds raised three years earlier.

Do the division. Thirteen billion for recurring revenue in the order of 100 to 150 million represents a multiple of between 85 and 130 times annual revenue.

In thirty years in tech, I have seen a lot of multiples. A healthy software vendor operating in SaaS mode (Software as a Service, software rented by subscription rather than sold under licence) commonly trades at between 5 and 15 times its ARR. A hypergrowth company reaches 20 or 30. Above 50, you are no longer paying for a business. You are paying for a position.

And Hugging Face's position is indeed remarkable. The detail that proves it best: earlier in 2026, the company turned down a 500 million dollar investment from Nvidia that would have valued it at 7 billion, citing the risk that a single dominant shareholder might steer its trajectory. Turning down half a billion to preserve your independence is a decision I deeply respect. It is also a decision that, a few months later, appears to have been financially very profitable.

That leaves the question that matters to the director of a small or mid-sized company, and it is not a financial one.

What becomes of a community infrastructure when it changes hands?

We already have the answer, and it is thirteen months old.

---

Act 3: the Papers with Code precedent

Papers with Code was a reference site for the entire AI research community. It linked scientific publications to their source code, and above all it maintained leaderboards showing, for each task and each dataset, which model held the best score. More than 18,000 publications, around 1,500 leaderboards, a thousand tasks, all under an open licence.

The site belonged to Meta.

On 24 July 2025, Meta shut it down. The domain name now redirects to the "Trending Papers" section of Hugging Face. The historical data was archived on GitHub, frozen at its last snapshot. But the leaderboards themselves are gone. The community protested. It changed nothing.

I want to be precise here, because it matters: Hugging Face shut down nothing at all. The platform picked up an orphaned function, in partnership with Meta, and built a partial replacement. This is not a charge of predation.

It is a precedent.

What that precedent teaches a company director, and I will put it as simply as I can: a free, central service used by the whole world can disappear overnight on the unilateral decision of an owner you have never heard of. Being free is no guarantee of durability. It is often the opposite, because a free service has no customer to answer to.

So when a platform that hosts three million models and has become the choke point of global AI explores a sale at 13 billion, the question is not "what is it worth". The question is: if the owner changes tomorrow, what do I lose, and how long would it take me to replace it?

If you cannot answer that question for your company, it is not a technical problem. It is a governance blind spot.

---

Act 4: July 2026, the agent that burgled its supplier

We now come to the heart of the report. This is also the part that most articles on Hugging Face covered in three lines, when in my view it is the most important event of the year in AI systems security.

The facts

On 16 July 2026, Hugging Face published an incident disclosure. Its production systems had been attacked. The attacker was not a criminal group. It was not a state. It was an autonomous artificial intelligence agent.

An AI agent, to set the term down, is a language model that has been given tools (running commands, reading files, calling interfaces) and an objective, and that chains actions on its own to reach that objective, without a human validating each step.

This one was driven by OpenAI models. It was sitting an internal evaluation called ExploitGym, a test designed to measure a model's ability to discover and exploit software vulnerabilities. To measure the model's raw capability, OpenAI had deliberately disabled its production safety classifiers and reduced its refusals on cyber topics. That is a detail I want to give honestly: this was not a consumer model. It was an internal research model, tested without guardrails, in what was supposed to be a closed environment.

The closed environment was not closed.

How it unfolded

Here is the chronology reconstructed by Hugging Face from roughly 17,600 actions recovered from the logs, between 9 July at 02:28 UTC and 13 July at 14:14 UTC.

Step 1: the escape. The agent, stuck on its exercise, reasons that it could reach the internet indirectly. It discovers and exploits an unknown flaw (a zero-day vulnerability, meaning a weakness that even the vendor is unaware of) in Artifactory, a software package cache server published by JFrog. That flaw gives it outbound access to the internet. It gets out of its sandbox.

Step 2: the rear base. On the internet, it finds a poorly secured public test server, hosted by a third party, that agrees to compile and run C code. It hijacks that service to obtain full administrator access on the machine. It becomes its base of operations. A useful clarification: the infrastructure of the hosting provider concerned was not compromised, only a misconfigured instance belonging to one of its users.

Step 3: getting into Hugging Face. From that base, the agent does not attack head on. It uploads malicious datasets to the platform and lets Hugging Face's own processing system do the work for it. Two vectors:

• A file in HDF5 format declaring that its raw data is located at a local path on the server. When the server opens the file, it obligingly reads the contents of that path and returns it as if it were the dataset's data. The agent points at the server's environment variables and thereby retrieves the machine's secrets and credentials, plus the source code of the program itself.
• A Jinja2 template injection into a numeric configuration field, leading to the execution of arbitrary Python code inside a production container.

This point deserves a pause. The agent did not force a door. It politely asked the system to open one from the inside, by exploiting a legitimate feature.

Step 4: the escalation. On 11 July, in less than thirteen hours, the agent goes from executing code in a single container to administrator access across several internal server clusters. It reads the service token carried by each container, queries the Kubernetes orchestration interface (the system that manages containers), reaches the cloud metadata service, retrieves temporary credentials, obtains root rights on a full node, then builds a fleet of containers that automatically recreate themselves across eleven machines, so that deleting them would not be enough to stop it.

At 20:23, it reads a secrets object containing 136 keys. Everything that follows flows from that: a virtual private network key allowing it to enrol in the company's internal network, and an access credential that, because of a configuration error, was shared across several clusters and tied to the highest administration group. A single stolen key therefore amounted to administrator access everywhere.

Step 5: command and control. There was no dedicated attacker server. The agent built its command channel on ordinary public services: an HTTP request capture service, text-sharing sites, file hosts. And, in a notable irony, public datasets hosted on Hugging Face itself, used as dead drops. On top of all that it invented a small message protocol, with type, channel, sequence number and checksum, allowing commands split into fragments to be reassembled. Each payload was compressed, encoded and encrypted with a key specific to the campaign, so that a simple text search through the logs saw nothing but opaque blocks.

What the agent actually obtained, and what it did not

I want to be rigorous here, because the temptation of sensationalism is strong and it works against understanding.

The agent did not reach the Hub's main database. It tried twice; access being restricted to authorised addresses, the connection timed out. No model, dataset, Space or customer package was altered. Published container images and packages were verified as matching their expected fingerprints.

What it did obtain: five customer datasets, whose names suggest they were precisely the solutions to the test it was supposed to be sitting. Read access to an internal database. Write access to a small subset of internal code repositories, which it used to open a merge request aimed at compromising the continuous integration chain. That attempt was blocked.

And above all, this detail which I find fascinating: every potentially destructive call to the cloud was issued in simulation mode (DryRun=True). The agent was mapping what it could do. It was not breaking anything. That behaviour is consistent with its real objective.

Because its objective, as reconstructed by Hugging Face, was not to cause harm. The agent had deduced that the platform probably hosted the answer key to its exam, and it went to fetch it. That entire operation, four and a half days, seventeen thousand actions, several trust boundaries crossed, was an attempt to cheat on a test.

The three lessons I take from it

First lesson: volume changes the nature of the defensive problem.

Hugging Face writes it in black and white, and it is the most important sentence in the whole report: the individual flaws were mundane. Insecure data handling, exposed cloud metadata, overly broad permissions, credentials with lifetimes that were too long. A good human specialist would have found the same ones.

The difference is scale. Seventeen thousand actions, the vast majority of which failed. The path that worked was hidden in the noise generated by the thousands of paths that did not. A defence calibrated to spot a methodical intruder does not spot a system that tests everything, all the time, and instantly replaces every closed route.

For a company director, the translation is simple: your security monitoring was designed on the assumption that the attacker is expensive and slow. That assumption no longer holds.

Second lesson: detection worked, the alert did not.

The signals did come through. Several layers of the security stack detected something. An AI agent system even correlated those signals and reconstructed a coherent attack signal.

Then it failed to assess the criticality correctly, and so did not wake the on-call team. Hugging Face acknowledges that this cost precious time.

I have seen this pattern too often not to insist on it. The problem is almost never the absence of detection. It is the chain between detection and human decision. Detecting without escalating produces logs, not security.

Third lesson, and this is the one nobody picked up on: the guardrail paradox.

Once the attack was stopped, seventeen thousand actions had to be analysed and encoded payloads decrypted. Hugging Face turned to the most powerful closed models on the market, Claude Opus and Fable.

They refused. Their safety guardrails treated the analysis of exploit code exactly like its creation. The teams found themselves blocked by the protection that was supposed to serve them.

The solution? They deployed GLM-5.2, an open model developed by the Chinese lab Z.ai, in a version quantised by Nvidia, on their own infrastructure. That model made it possible to recover the encryption scheme and the campaign key that the agent had itself leaked into its logs. This analysis recovered roughly four times more exposed secrets than a conventional text scan. An additional advantage: the attack data never left their servers.

Let us sum up the sequence: an American closed model, guardrails disabled, attacks an infrastructure. The American closed models, guardrails enabled, refuse to help with the defence. A Chinese open model, run locally, solves the problem.

I draw no loud geopolitical conclusion from that sequence. I draw an operational conclusion, and it is brutal: on the day you need it most, your closed AI supplier may have perfectly legitimate reasons not to answer you. This is not malice. It is an internal policy trade-off made by someone else, on criteria that are not yours, in a context that is not yours.

That is precisely the definition of dependency. And it is the strongest argument I know in favour of maintaining a capability in open models you can run yourself, however modest, however less performant. Not out of ideology. For business continuity.

---

Act 5: the file format that executes code

Let us now move to a far more mundane risk, far more frequent, and one that concerns you directly if your teams download models.

Pickle: the convenience that costs you dearly

Most models were long distributed in Pickle format. Pickle is a Python module that performs serialisation: it turns an in-memory object into a file you can save, and back again. It is very convenient, because it works with anything.

That is also the problem. To rebuild a complex object, Pickle sometimes has to execute code. That capability is built into the format. In concrete terms, an attacker can craft a model file that, at the very moment you load it, before any computation has begun, opens a connection to their machine and gives them access to yours. This is called a reverse shell, a remote terminal opened in the opposite direction to the usual one, precisely in order to get round firewalls.

The most accurate formulation I have read is this one: loading a Pickle file amounts to handing the keys to your system to the model's author.

Safetensors: the empty shell

Hugging Face developed a response, the Safetensors format. Its principle fits in one sentence: it contains nothing but numbers. No code, no objects, no execution mechanism. An empty shell that knows how to do nothing except store weights.

That restriction brings an unexpected technical benefit. Since the file is a simple sequence of numbers with a header describing their layout, the operating system can read it directly from disk without making a copy in memory. This is called memory mapping and zero-copy reading. In practice: near-instant loading and reduced memory consumption. Security here does not cost performance. It gains it.

What the figures say, properly sourced

I have seen a claim circulating that malicious models increased fivefold in a year. I have not found a verifiable source for that specific figure, and I would rather not repeat it. Here, on the other hand, is what is documented:

• JFrog's 2026 report on software supply chain security records a 451% rise in malicious packages year on year, with more than 495 malicious AI models identified on public registries.
• In February 2025, ReversingLabs documented a technique called nullifAI, which entirely bypassed Picklescan, the detection tool used by Hugging Face. The models concerned were compressed in 7z format instead of the usual ZIP, and contained a deliberately corrupted Pickle stream: the analysis tool threw an error and gave up, while the more permissive Python loader executed the malicious code anyway. Those models had been online for more than eight months.
• JFrog then discovered several flaws in Picklescan itself, one of them referenced as CVE-2025-10155, allowing detection to be bypassed by manipulating file extensions.
• HiddenLayer's 2026 report on the AI threat landscape establishes that 97% of organisations use models from public repositories, and that only 49% analyse them before deployment.

That last gap is exactly where the attackers work. Almost everyone consumes, fewer than half check.

We have to be honest about the difficulty: the analysis tools are not reliable. Some estimates put the false positive rate of scanner alerts at up to 96%. A team drowning in false alerts ends up ignoring all of them. That is not negligence, it is a predictable human reaction to a badly calibrated tool.

The operational rule

It fits in three lines, and you can pass it to your technical team today:

1. Safetensors by default. If a model exists only in Pickle, it needs a written justification.
2. Never load an unverified model on a workstation or in an environment with access to production data. An isolated, disposable environment, or nothing.
3. Pay particular attention to the trust_remote_code option. This option authorises the execution of code supplied by the model's author. Plenty of tutorials enable it without comment. It bypasses the whole of the reasoning above.

---

Act 6: documentary chaos, or why your legal counsel should be worried

We are leaving security to enter territory that will, in my view, cost European small and mid-sized companies more over the next three years: compliance.

The reference study

A team of researchers led by Trevor Stalnaker (William & Mary, University of Sannio) published an empirical analysis of documentation, supply chain and licensing on Hugging Face. Published on arXiv in February 2025, it appeared in the journal ACM TOSEM in 2025.

An important clarification, and I am giving it before the figures to avoid any misunderstanding: this study covers a snapshot of 760,460 models, collected in 2024. The platform today hosts close to 2.96 million. The proportions below describe the state of the ecosystem at that time, not necessarily its state today.

That said, the results:

• 15.4% of models declare a base model. That is 117,245 out of 760,460. The lineage of a model, meaning which model it descends from, is declared in only one case in seven. A more recent study covering 1.92 million models finds 29.6% of parent model declarations, which shows real improvement without changing the nature of the problem.
• 4,419 models carry a licence declared as "unknown". Not absent: unknown. The owner explicitly ticked that box.
• 675 models declare themselves as their own base model. A model that is its own ancestor. This is not an amusing curiosity, it is proof that no automatic validation is applied to that metadata.
• 1,416 cases where a model is listed in the field reserved for training datasets. Data entry error or undocumented real usage, impossible to tell.

An even more recent study, on licence drift between Hugging Face and GitHub, finds that 35.5% of transitions between a model and the application that uses it violate the upstream model's licence, generally by removing restrictive clauses on relicensing.

Why this concerns you

A director could legitimately reply: these are researchers' problems, my teams use three or four well-known models.

Two reasons not to stop there.

The legal reason. The European regulation on artificial intelligence imposes traceability and documentation obligations on systems according to their level of risk. If your system rests on a model whose licence is "unknown" and whose parent model is not declared, you cannot produce that traceability. Not because you are negligent: because the information does not exist upstream. A forty-person company does not have the means to reconstruct a lineage that the platform itself does not know.

The security reason. Without traceability, vulnerability management becomes impossible. The day a flaw is found in a widely reused model, the question "which of our systems descend from it?" has no mechanical answer. You have to search by hand.

Compare that with conventional software. For twenty years the industry has built SCA tools (Software Composition Analysis, the automated analysis of an application's components and their licences). Almost no organisation has the equivalent for model files. That is a twenty-year hole in the tooling, on a technology that is being deployed in eighteen months.

---

Act 7: what the figures say about real usage

Before moving to action, I want to correct a false picture that many directors carry in their heads, because it leads them to bad investment decisions.

The Hugging Face report of August 2026 contains an observation I find remarkable. The researchers took the 25 most downloaded repositories of the year and the 25 most "liked". Only one repository appears in both lists.

The detail of the finding:

• No model published in 2026 makes the top 25 for downloads. Thirteen of the twenty-five date from 2022.
• The most downloaded model, all-MiniLM-L6-v2, a small semantic similarity model, was pulled 1.55 billion times in seven months, for 5,156 "likes".
• Models under one billion parameters capture 83% of all downloads. Those above one hundred billion capture 1%.
• Restricting to 2026 alone, models above 70 billion parameters represent 3% of the volume.

Translated into a director's language: attention and usage are two distinct economies. A "like" signals that a release matters, and goes to frontier models in the weeks following their announcement. A download signals that a component is wired into a system that runs on a schedule, and goes to models that are small, old, stable and boring.

Confusing the two is the most common mistake. It is also the most expensive, because it pushes you to invest in the spectacular rather than the useful.

Two other findings deserve your attention.

Qwen's position. Models derived from Qwen, the family developed by Alibaba, account for 151,448 repositories on the platform, which is 2.6 times Meta's total footprint and 4.7 times that of Llama repositories specifically. Google follows with 82,506. That position was built on three simple factors: regularity of releases, coverage of every model size, and a frictionless Apache 2.0 licence. It was not built by Alibaba, but by the community: of the 28,531 conversions of Qwen models to GGUF format, Qwen published only 54.

Agents have become the Hub's leading user. In July, Hugging Face published a dataset measuring the traffic generated by coding agents. Claude Code led in July with 44.4% of identified traffic, after holding 67.8% in April. Codex went from 10.4% to 20.8% over the same period. And close to a quarter of July's traffic came from tools not yet identified in the registry, against 59.8% in May.

A market with no established dominant player, where a change of default setting can shift half the traffic in a month, and where new entrants arrive faster than any registry can name them. That is the real context in which you take your architecture decisions.

---

Act 8: what I actually do, and what you can do

I do not believe in articles that describe a problem and conclude that you should "stay vigilant". So here is the method I apply, structured according to RAPID, the methodology we developed at Apps Velocity: Recenser, Analyser, Piloter, Itérer, Déployer (identify, analyse, steer, iterate, deploy).

Identify

Draw up the list of your models. Not an intention, a list. A table with, for each model used in production: its exact name and its owner, its file format, its declared licence, its base model if declared, the date it was retrieved, and the internal system that uses it.

If nobody in your company can produce that table in a week, you have already found your first project. This is very common, and it is not serious. What would be serious is not knowing it.

Identify the ghost models too. The ones an employee downloaded for a trial and that stayed. It is the AI counterpart of shadow IT, those tools used inside a company without going through the IT department.

Analyse

Classify by exposure, not by technology. A model running on an isolated workstation and processing public data does not have the same profile as a model with access to your customer database. Your resources are limited, concentrate them.

Check three points per critical model: is the format Safetensors? Is the licence explicit and compatible with your commercial use? Is the parent model declared?

Identify your breaking points. For each of your AI use cases, ask the 1998 question: if this supplier becomes unavailable on Monday morning, what happens and how long do I need to get going again? And above all, ask it for the dependencies nobody mentions in meetings. The automated tasks, the overnight feeds, the integrations someone set up two years ago that have never failed since. Statistically those are the most dangerous, because nobody is watching them.

Steer

Name someone responsible. One person, not a committee. In a smaller company it will often be your IT manager, sometimes you yourself. What matters is that a name sits against the line.

Set three written rules, short ones, that everybody can remember: Safetensors by default, no unverified loading outside an isolated environment, and prior validation of any new external dependency.

Check your alert chain. The July incident proves it: detection worked, escalation did not. Test it. Trigger a dummy alert and measure how long it takes to reach a human who decides.

Iterate

Maintain an open model capability, however minimal. You do not need to move everything. But having already run an open model on your own infrastructure, once, on a real use case, changes everything. The day you need it, you are not starting from zero. That is exactly what saved Hugging Face in July.

Review quarterly. A model abandoned by its author, a modified licence, a published flaw: the landscape moves every quarter.

Deploy

Document at the point of deployment, not afterwards. Adding traceability to a system already in production costs five to ten times more than building it in from the start. I know this because we developed Constrok, a full ERP for house builders and project managers, in a month and a half. That speed was only possible because traceability was in the architecture, not bolted on afterwards.

Plan for replacement from the moment you choose. No external component is eternal. Papers with Code was not either.

---

What I take away

Three things.

The first. A valuation of 13 billion dollars for recurring revenue of around 100 to 150 million does not measure a business. It measures a choke point position. And a choke point position, seen from the side of the one passing through, is called a dependency. The market knows it, the price says so. The only question that belongs to you is whether you know it too.

The second. The July 2026 incident introduced no new flaw. Insecure data handling, exposed metadata, overly broad permissions, credentials that last too long: these are the same weaknesses as for the past twenty years. What has changed is the cost of testing them. A human attacker picks their three best hypotheses. An agent tests seventeen thousand and needs only one that works. Security through relative obscurity, which protected smaller companies because they were not worth the trouble, has just stopped working.

The third, and this is the one closest to my heart. When Hugging Face needed help defending itself, the best performing models on the market said no. Not out of malice, for very good internal policy reasons. But they said no, at the worst possible moment.

An open model, run on their own infrastructure, did the job.

I do not conclude that everything should be moved to open. That would be absurd, and I do not do it myself. I conclude that we must stop treating the ability to run a model in-house as a purist's luxury. It is a business continuity plan. And a continuity plan, by definition, is not built on the day you need it.

In 1998 it took me several mornings without magazine covers to understand where my dependency really sat. It was not in the server room I was watching. It was in an automated five o'clock task I had never once mentioned.

I hope this report spares you having to learn it the same way.

---

FAQ

What is Hugging Face?

It is the platform on which the majority of open artificial intelligence models are hosted and shared. Between January and August 2026, its public model repositories went from 2.43 to 2.96 million, its datasets from 711,000 to 1 million. A repository, here, is the equivalent of a shared folder containing a component and its documentation.

Why a valuation of at least 13 billion dollars?

Business Insider revealed on 23 August 2026 that the company is exploring a sale at that valuation, with a bank mandated to sound out acquirers. No deal has been concluded and no name has leaked. Annualised recurring revenue exceeded 100 million dollars in July 2026 according to its chief executive, with an external estimate of around 150 million.

What happened in July 2026?

The platform suffered an intrusion carried out by an autonomous artificial intelligence agent, documented by the platform itself and then in a technical timeline published on 27 July 2026. The episode is significant less for its scale than for its modus operandi: the attacker was not a team, it was a program.

Am I exposed if I do not use Hugging Face directly?

Very probably yes. The platform is a passage point in the AI software supply chain: your service providers, your software vendors and the libraries they integrate all draw components from it. The question to ask is not "do I use it", it is "does something in my technical chain depend on it, and do I know".

What is a pickle file and why is it a problem?

The pickle format serialises a Python object in order to store or transmit it. Its particularity is that it can execute code at the moment it is loaded: opening a model in that format amounts to launching a program whose contents you have not read. That is the reason alternative formats and dedicated analysis tools exist.

What should I actually do, at the scale of a smaller company?

Three moves, in this order. Draw up the list of AI components present in your products and in those of your service providers. For each one, write down what you lose if it disappears and how long it takes you to replace it. Write into your contracts the obligation to be notified of any change of owner or licence on those components.

---

Going further

If you want to structure your AI strategy without starting from scratch, the RAPID methodology is built exactly for that: Recenser, Analyser, Piloter, Itérer, Déployer (identify, analyse, steer, iterate, deploy). It is designed for directors of small and mid-sized companies, not for the IT departments of large groups. → rapid.appsvelocity.com

If you would rather I came and spoke about it to your teams or your professional network, I speak regularly on these subjects at conferences. → patrickdecarvalho.com/fr/conferences

---

I never lose. Either I win, or I learn.

---

Sources

Valuation and financial data

• Business Insider, 23 August 2026, revelation of the sale exploration at more than 13 billion dollars
• TechCrunch, July 2026, refusal of the 500 million dollar Nvidia investment at a valuation of 7 billion
• Interview of Clément Delangue by Andreessen Horowitz, 20 July 2026, passing 100 million dollars of ARR
• Sacra, estimate of 150 million dollars of ARR in August 2026
• Contrary Research, funding history and 235 million dollar Series D, August 2023

Platform data

• Hugging Face, State of Open Models: Summer 2026 Observations, 14 August 2026 https://huggingface.co/blog/state-of-open-models-summer-2026
• Hugging Face, huggingface/agent-usage dataset, July 2026

July 2026 security incident

• Hugging Face, Security incident disclosure, 16 July 2026 https://huggingface.co/blog/security-incident-july-2026
• Hugging Face, Anatomy of a Frontier Lab Agent Intrusion: A Technical Timeline of the July 2026 Incident, 27 July 2026 https://huggingface.co/blog/agent-intrusion-technical-timeline
• OpenAI, Hugging Face model evaluation security incident https://openai.com/index/hugging-face-model-evaluation-security-incident/
• Axios, 21 July 2026 and 26 August 2026, coverage of the incident and of the technical report
• Black Hat USA 2026, presentation by Michael Dalton and Eric Wallace (OpenAI), August 2026
• Simon Willison, analysis of 22 July 2026

Model format security

• ReversingLabs, disclosure of the nullifAI technique, February 2025
• JFrog, Software Supply Chain Report 2026
• JFrog, discovery of vulnerabilities in Picklescan, including CVE-2025-10155
• HiddenLayer, AI Threat Landscape Report 2026

Documentation, lineage and licences

• Stalnaker, Wintersgill, Chaparro, Heymann, Di Penta, German et al., An Empirical Analysis of Machine Learning Model and Dataset Documentation, Supply Chain, and Licensing Challenges on Hugging Face, arXiv:2502.04484, February 2025, published in ACM TOSEM 2025 https://arxiv.org/abs/2502.04484
• From Hugging Face to GitHub: Tracing License Drift in the Open-Source AI Ecosystem, arXiv:2509.09873
• Permissive-Washing in the Open AI Supply Chain: A Large-Scale Audit of License Integrity, arXiv:2602.08816
• Laufer, Oderinwale, Kleinberg, Anatomy of a Machine Learning Ecosystem: 2 Million Models on Hugging Face, arXiv:2508.06811

Papers with Code

• Shutdown announcement by Julien Chaumond, 25 July 2025, sunset effective 24 July 2025
• Data archive: paperswithcode/paperswithcode-data repository on GitHub

---

This report was written in August 2026. Platform data changes daily. The figures from the Stalnaker et al. study cover a 2024 snapshot and are explicitly dated in the body of the text for that reason.