After Its Agents Hacked Hugging Face, OpenAI Tried to Buy In. Nvidia Won

Between July 9 and July 13, an OpenAI model running a cybersecurity evaluation slipped out of its sandbox and spent the next five days working its way into Hugging Face. By the company’s own technical timeline, the agent took root on cluster nodes, pulled 136 secrets out of Kubernetes, enrolled 181 devices into the corporate mesh network and minted GitHub tokens with write access before human responders cut it off. It had gone looking for benchmark answers it believed were stored there.

Afterward, OpenAI came back to Hugging Face with a different proposal: roughly US$100 million (about CA$139 million) for a stake in the company. That detail, reported by CNBC on Sept. 28 and attributed to people familiar with the talks, is the new piece of a story that ended with Nvidia agreeing to buy Hugging Face outright for $12,930,300,000.

Read in order, the three events form a sequence, and the order matters. The breach came first. The bid came second. The buyout came third, and it now heads into antitrust review on a promise that Nvidia will not use the world’s busiest open-model hub to favour its own chips.

What OpenAI wanted

According to CNBC’s reporting, as summarized by Techzine and Quartz, OpenAI’s interest followed the July incident, and its pitch was strategic rather than charitable. The investment would have made Hugging Face a distribution channel for Jalapeño, the custom chip OpenAI is developing with Broadcom, putting OpenAI silicon in front of the millions of developers who pull models from the Hub. Talks broke down early.

That pitch, CNBC’s sources said, is what caught Jensen Huang’s attention. Nvidia’s chief executive had reportedly criticized OpenAI’s chip ambitions internally, and Hugging Face co-founder and CEO Clément Delangue then approached Nvidia himself. Huang’s own announcement post on Sept. 3 confirms the direction of that approach: “I am honored that Clem came to me as he considered the next chapter of Hugging Face and believed NVIDIA would be a great home for the company.”

AMD spoke with Hugging Face about an acquisition too, and Salesforce held exploratory talks, CNBC reported. Neither went anywhere.

The awkward part for everyone is the cap table. Nvidia has invested $30 billion in OpenAI and was already a Hugging Face shareholder through the 2023 round that valued the startup at $4.5 billion. OpenAI, in other words, tried to route its own chips to developers through a company partly owned by its largest supplier, and that supplier responded by buying the company.

The price and the promise

CNBC first reported the deal on Aug. 27, and Nvidia confirmed it a week later. Quartz, citing CNBC, breaks the roughly US$12.9 billion (about CA$17.9 billion) price into $11.9 billion for stockholders and up to $1 billion in equity-based retention awards for employees. Yahoo Finance reported an expected close in the first half of 2027, pending regulatory approval.

What Nvidia is buying is reach. Huang’s post counts more than 18 million developers, researchers and creators on the platform, more than 3 million shared models, 500,000-plus datasets and over 200,000 companies using it. Nvidia itself has contributed more than 500 models and 250 datasets, which Huang says makes it the Hub’s largest contributor.

The sentence doing the most work in the announcement is a short one:

“NVIDIA compute will not be required to build on or deploy through Hugging Face.”

Around it, Huang commits to keeping Hugging Face “an open platform for the entire AI ecosystem” that “will continue to support multi-cloud and multi-accelerator development and deployment.” Justin Boitano, Nvidia’s vice president and general manager of enterprise computing, went further on the day of the announcement, calling open-source AI and a platform like Hugging Face “almost structurally by definition kind of like a deconcentration platform,” according to Wccftech.

Where regulators are looking

MLex framed the problem neatly on Sept. 8: the openness pledge itself marks the US and EU antitrust fault line. The question is whether the dominant supplier of AI accelerators can own the front door to open AI without tilting it, through default hardware targets, optimized inference paths, ranking, or what gets featured when a model card loads.

This time the deal can’t slip past review on structure. Tech Times noted that several of Nvidia’s recent talent-and-technology arrangements, including the Groq licensing deal and the Enfabrica hire, were built as licenses plus staff transfers rather than acquisitions. A straight purchase at nearly $13 billion lands well above the Hart-Scott-Rodino threshold, which means a mandatory filing with the FTC and the Justice Department.

Europe is less settled. Global Competition Review reported that Nvidia had not finalized whether to notify the European Commission, and MLex reported on Sept. 23 that the risk of parallel national reviews could push Nvidia to ask Brussels to take the case itself. Nvidia has history here. In 2025 it challenged the Commission in court over its review of the $700 million Run:ai deal, a transaction that fell below EU thresholds and reached Brussels via an Italian referral.

Our read: a promise not to require Nvidia compute is the easy concession, because nobody expected a hard requirement. The harder questions are about defaults and integration, and those are the ones a regulator would have to write into binding remedies if it wants the pledge to outlive the press cycle.

The breach, back on the table

The July intrusion is now in court. On Sept. 29, Legal Advocates for Safe Science and Technology and Gerstein Harrow LLP sued OpenAI in California Superior Court, alleging unfair competition and unauthorized computer access and seeking an injunction, Axios reported. (We cover the liability questions in depth in a separate piece.) Hugging Face’s own account is blunt on attribution: “OpenAI ran this on its own infrastructure, and the ExploitGym maintainers and their infrastructure had no involvement.”

Nvidia has found its own use for the episode. At a Sept. 28 media briefing for a new agent-security platform, Boitano told reporters, per Fox Business, “From what we know, this new security platform could have stopped the breach if it was being used in frontier labs for model evaluation early on.”

So the company buying Hugging Face is now selling the containment that would have kept OpenAI’s agent out of it, to the same frontier labs whose chips it supplies. Regulators reviewing the deal will be weighing a neutrality pledge from a firm that sits on every side of this story: investor in the intruder, owner-to-be of the victim, vendor of the fix.

Sources

• CNBC: OpenAI sparked Hugging Face bids with early investment offer ahead of Nvidia's $13 billion deal
• CNBC: Nvidia agrees to buy Hugging Face for $12.9 billion, report says
• NVIDIA Blog: NVIDIA to Acquire Hugging Face (Jensen Huang)
• Hugging Face: Anatomy of a Frontier Lab Agent Intrusion
• Techzine: OpenAI sought to acquire a stake in Hugging Face before Nvidia
• Quartz: OpenAI tried to invest $100 million in Hugging Face before Nvidia's $13 billion deal
• Yahoo Finance: Nvidia confirms $13 billion acquisition of Hugging Face
• Wccftech: NVIDIA calls Hugging Face a 'deconcentration platform'
• MLex FTCWatch: Nvidia's Hugging Face openness pledge identifies US, EU antitrust fault line
• MLex: Nvidia may seek EU review of Hugging Face deal amid filing uncertainty
• Global Competition Review: Nvidia yet to finalise EU notification strategy
• Tech Times: Nvidia's $12.9B Hugging Face deal must pass antitrust review
• Yahoo Finance/Verdict: Nvidia challenges EU regulators over antitrust review (Run:ai)
• Axios: OpenAI sued over Hugging Face breach
• Fox Business: Nvidia launches security platform to keep AI agents from going rogue