Nvidia bought Hugging Face for $12.9B. The real exposure is one line in your build script.

I have shipped systems that are not allowed to touch the internet. An offline multilingual AI avatar for an automotive client in Germany. Real-time drone threat detection for defence and police users, where the entire point is that inference happens on the device, in the field, with no uplink to lose.

Every one of them started life with a build script that pulled weights from Hugging Face.

That is the part worth sitting with. On Thursday Nvidia confirmed a definitive agreement to acquire Hugging Face for $12.9 billion: roughly $11.9 billion payable to shareholders and up to $1 billion in retention equity for employees joining Nvidia. It is expected to close in the first half of 2027, subject to regulatory approval. Jensen Huang wrote that the platform will remain an open platform for the entire AI ecosystem, and went further than most acquirers bother to: Nvidia compute will not be required to build on or deploy through Hugging Face.

I believe him. That is not my concern.

My concern is structural, and it has nothing to do with anyone's intentions.

For most teams, "we run offline" means the model runs offline. It does not mean the model arrives offline. Somewhere in the pipeline, in a Dockerfile or a CI job or a first-run bootstrap, there is a call that reaches out to one registry, resolves a name, and downloads whatever that name points to today. The inference is local. The supply chain is not.

Eighteen million developers use that platform. Half a million datasets, a million applications, more than two hundred thousand companies. That is not a repository anymore. That is default infrastructure, and default infrastructure is the kind people stop auditing.

Here is the rule I have ended up with after enough deployments in places where the network is a luxury: an openness promise is a governance control, and governance controls change owners. A local mirror does not.

Concretely, that means three things.

Pin by hash, not by name. A tag is a pointer that someone else can move. A commit hash or a checksum is a fact. If your build cannot tell you which exact bytes it shipped last quarter, you do not have a reproducible system, you have a lucky one.

Keep your own copy of the weights. Not a cache that silently repopulates from upstream, but an artifact store you control, that a fresh machine with no internet access can build from. The test is simple and worth actually running: disconnect the build agent and see whether it still produces a deployable image. Most teams have never run that test. Most teams fail it.

Write down what you would do if the terms changed. Not the model licence, the platform terms. Rate limits, gated repositories, region availability, authentication requirements. Those are the things that move quietly long after the press cycle ends, and they move on somebody else's schedule rather than yours.

None of this is a prediction that the platform gets worse. The commercial logic runs the other way. The value of that hub is its neutrality, and buying it in order to narrow it would mean paying thirteen billion dollars for something you then broke. I expect it stays open, and the analysts covering the deal broadly expect the same, at least in the near term.

But "I expect it stays open" is a sentence about a company's incentives. It is not an engineering control.

In every regulated deployment I have worked on, across defence, automotive and education, the question that gets asked in the security review is never "do you trust your vendor". It is "what happens if the vendor is gone". Those are different questions, and only one of them has an answer you can test on a Tuesday afternoon.

The acquisition did not create this exposure. It revealed it. Those weights were always sitting on somebody else's server. It just happened to be a server run by a company with no particular reason to change anything. Now it will be run by the company that also makes the chips, the runtime and the optimisation stack, and even on the most generous reading, that is one more party whose roadmap your build script quietly depends on.

We spent years arguing about open weights versus closed weights, as though the licence were the whole story. It never was. A model you are legally free to run but cannot rebuild without a network call is open in roughly the way a library book is yours.

Mirror your weights this week, while nothing is wrong. That is the only time it is cheap.