Visa’s open-source security harness now finds the vulnerability, writes the fix, and turns an adversarial panel on its own patch before any human reviews it. The whole loop ships on by default. A plain scan of the Visa Vulnerability Agentic Harness runs all 11 stages and edits source files in the target repo unless the operator caps it at detection.

The announcement Thursday pairs the release with an expansion of the Visa Consulting & Analytics advisory practice. Visa is shipping that default 18 days after Tenet Security demonstrated GhostJacking on the DEF CON 34 main stage, an attack chain in which an agent read an attacker’s payload out of a log file and rewrote DNS with a valid credential. Two days earlier, Steve Wilson, Chief AI and Product Officer at Exabeam and project co-lead for the OWASP Top 10 for LLM Applications, made the case in VentureBeat for the opposite default. “The first thing I’d do is put an authorization gate outside the model,” Wilson said in written responses. “The agent can propose the exact DNS change, but it cannot grant itself the authority to make it.”

The bottleneck moved, so Visa moved the pipeline

Rajat Taneja, Visa’s president of technology, rejects the premise that the default is a risk decision and calls it the product. “The bottleneck has moved,” Taneja told VentureBeat in an exclusive interview. “AI is finding vulnerabilities faster than humans can in the history of our technology industry. The new bottleneck is fixing and proving we have fixed things.”

VVAH grew out of Visa’s participation in Anthropic’s Project Glasswing, where the company aimed Claude Mythos at the network behind billions of daily transactions and watched the model chain minor weaknesses into working exploits, a hunt VentureBeat covered in July. “VVAH initially was completely only using Mythos, and that’s when all of us, as part of Project Glasswing, realized the power of this new class of models that does semantic reasoning,” Taneja said.

The harness went to GitHub in June and has climbed from 595 stars and 97 forks on July 20 to more than 2,300 stars and 300 forks as of August 25, with a clone-to-visitor ratio Taneja put near 9%. “We have got some very high-profile companies that have started using this harness,” he said.

Why give it away? Taneja’s answer starts with Visa’s technology DNA and a harness built “to protect Visa and our ecosystem.” The reason he leaned on hardest was obligation, “to do good by doing right” for “companies who may not have the same level of investments or knowledge in cybersecurity.”

Contribution runs one way. The repo states it is not currently accepting external code contributions, so the harness that edits adopters’ source takes no code into its own.

Thursday’s release extends the pipeline past the report. “We’re going from discover, verify, and report, and then fix it, to discover it, verify it, remediate it, validate it, and iterate it,” Taneja said. “If a fix doesn’t negate the exploit, then there should be a structured, automated feedback that preserves the learnings from the first run and then enhances it.” Underneath that loop, the release refactors scanning around an abstract syntax tree call graph that maps subroutine calls and the traversal paths an attacker could reach. Taneja argued the change cuts token counts while delivering “better reasoning, context, and better exploitability analysis.” On top sits MTTA observability across the stages, what he called a window pane, plus real-time progress views. “A pretty good step function,” he said of the release.

One metric, three definitions

Mean Time to Adapt, the metric Visa invented alongside the harness, gets a shorter definition in this release. The short form is the time between discovery and resolution of attack paths, with some resolutions, Visa claims, shrinking from weeks to hours. Visa published a wider construction in June, and the Project Glasswing white paper tracks MTTA along three dimensions that include inventory freshness, exploitable paths per release, and validation cycle time. The repo carries a third, elapsed time from AI-discovered exploitability to a validated fix in production. Board slides will quote the shortest interval. Ask for all three, because a resolution count that skips validation is what MTTA was invented to replace.

Taneja ranks MTTA as “the most strategically important metric” because it shifts the focus from scanning to how fast an enterprise adapts. His shorthand is blunter. “It’s not the finding. It’s the fixing that matters,” he said.

The default and the gate

Wilson’s argument went past naming the gate. “We have to remember that security rules written inside prompts may shape the model’s behavior, but they are still suggestions to the model, not enforceable security controls,” he wrote. He also priced the control honestly. “The tradeoff is that the agent loses the ability to improvise arbitrary, high-impact infrastructure changes on its own, while retaining autonomous investigation and routine, bounded remediation,” Wilson said.

The harness ships no approval step between patch and edited file. Where the human sits was the first question VentureBeat put to Visa in writing.

The company’s own June white paper sets the bar. “AI agents are identities” sits among its 12 non-negotiable practices, requiring scoped permissions, least privilege, audit trails, and IAM governance for every agent that modifies a system. VVAH’s shipped default is that agent.

“A lot of the traditional systems that are used today are basically signal providers,” Taneja told VentureBeat. “They are telemetry, and then it’s a lot of human analysis, and your SOC and your security and incident response teams doing a lot of the heavy lifting when they respond,” and that, he said, cannot work at this scale. He pointed to the Hugging Face incident and “other frontier models escaping sandboxes to do things more autonomously” as the preview. “We have seen the trailer of this movie,” Taneja said, and “every company in the world should prepare and rethink their architecture.”

What the harness automates is the adversarial step. Before a fix counts as validated, the panel scores whether the patch negates the exploit, Taneja’s test for done, with failed fixes feeding the next attempt, the iterate step Taneja described. Stage 11 itself runs read-only, per the README, and VVAH does not compile, build, or run tests against the patched tree. Taneja calls that wrapper “the governance architecture on top of that,” and chaining findings into working exploits takes threat modeling and business context, which is why he argued “the harness with a model is far more effective than somebody using the model by itself.”

Visa answers the gate question

VentureBeat put its questions to Visa in writing after the interview, and the answers arrived before publication. On why remediation ships on, the response repeated the bottleneck argument, then narrowed the scope. “VVAH is meant for authorized operators running against code they own, and in a controlled environment,” the company said in written responses.

The approval question drew the most specific answer. “VVAH is a harness, not a merge tool,” Visa wrote. “Stage 10 writes candidate fixes to a working copy of the repo. Stage 11 then runs an adversarial validation panel that scores each fix and returns one of three verdicts: validated, validation failed or needs review. None of these bypasses your normal build, test, and code review flow.” Humans, the company wrote, are “the gate in three places. Before running the tool. When reviewing the patches. And before anything gets merged.” “The final call on any fix stays with the security and engineering teams. In an enterprise, trust and auditability are not optional. The default flow is built around that.”

Set beside Wilson’s standard, the architecture lands close to his line and the sequence does not. Wilson’s gate clears an action before it happens. The default’s human gates open before the run and after the write. The attack is the automated part, and the three human gates sit outside the model, the boundary Wilson drew. “Our goal is to help security teams work at AI speed, not to replace them,” Visa wrote. “VVAH does the repetitive parts. It finds issues, tests whether they are real, and proposes fixes. Before a fix gets to a human, an adversarial validation panel at stage eleven tries to break it. That way the human is spending time on decisions that need judgment, not on triaging noise.”

Client zero got direct confirmation. “VVAH runs against Visa code today,” Visa wrote, and Taneja had volunteered the posture on the call. “We designed this and we were using it for ourselves, and we were client zero,” he said, adding “only when we saw the impact and the positive effect of what we were finding, we said every company would need this.” What adopters value, Visa says, is context. VVAH pulls in CMDB data, threat models, and business risk, and where “most tools stop at findings,” it “tries to answer, ‘which of these should you fix first, given how your business runs.’”

Model choice becomes a per-stage decision

Multi-model orchestration is the other substantive change. “Mythos has a very high recall, but the Opus model has very high precision,” Taneja said. “On stage one I want to use this model. On stage two I want to use this model,” is how Taneja framed the per-stage setup, with newer GPT releases in the ensemble and open-weight models where pricing stings, all through configuration rather than code changes. “The whole is greater than the sum of the parts,” as he put it. The harness was model-agnostic from day one, he added, and the evolution moved that choice into configuration, with prompt tuning and caching shared underneath. One boundary moved. In June, applying a fix required Anthropic backends, and OpenAI-compatible backends ran report-only. The current README extends remediation and validation to OpenAI-compatible and open-weight models through a shared model-agnostic runtime, with no single provider as a hard dependency, and the default routing for both stages stays Anthropic.

That flexibility lands on a market already churning. VentureBeat’s Q2 2026 Pulse research found 59% of enterprises plan to adopt or switch agent security tooling within the year, and 82% still rely on provider-native controls as the primary layer. Visa said Thursday it is contributing VVAH to Nvidia’s Open Secure AI Alliance as a model-agnostic framework and collaborating in Project Lightwell, the $5 billion IBM and Red Hat effort to harden open-source components.

Before turning fix mode on

Consulting is the other half of Thursday’s announcement. Visa Consulting & Analytics is adding executive workshops, a VVAH-informed maturity assessment scored on a NIST one-to-five scale, and a cyber risk prioritization roadmap. “We were getting a lot of calls. Hey, can you help?” Taneja said, and the practice “became very important to handhold and help those who are using it.” Carl Rutstein, global head of Visa Consulting & Analytics, framed it the same way. “Finding vulnerabilities is no longer the hardest part. Speed to remediation is the new battleground.”

Even with HTTPS keeping your activity on a website private, your network provider and anyone snooping on the connection can still see exactly which sites and apps you’re visiting. This privacy gap has quietly existed for years, and Google is now closing it with four major network security upgrades built into Android 17.

How Android 17’s Encrypted Client Hello (ECH) blocks ISP tracking

Your phone has been announcing its destination out loud this whole time. Every time you connect to a site, there’s a moment in the handshake called TLS ClientHello, where your device essentially broadcasts which domain it’s about to visit, in plain, readable text. Anyone watching the network, your ISP included, can read that.

Encrypted Client Hello scrambles that data so it’s unreadable to anyone but the site you’re actually visiting. Pair that with Private DNS, and your ISP loses the ability to track where you go or stitch your browsing into a profile. Android is the first major mobile OS to roll this out broadly, built alongside Jigsaw, with developer support landing through OkHttp 5.5.0.

Three other Android 17 security features rolling out

Beyond ECH, Android 17 packs in three more upgrades that close smaller but still crucial privacy gaps:

• Local Network Protection stops apps from silently scanning your home Wi-Fi to see what devices you own, whether that’s a smart TV, a security camera, or other connected gadgets, without asking your permission first.
• Certificate Transparency, now enforced by default, requires every website certificate to be logged publicly, making it harder for a compromised or rogue certificate authority to issue a fake certificate and intercept your traffic without getting caught.

• Zero-click 2G protection fights back against scams. Criminals use devices called SMS blasters to force nearby phones onto outdated, insecure 2G networks, then blast out phishing texts that slip past modern spam filters. Android 17 lets participating carriers disable 2G by default, shutting down that entire attack path automatically, with zero action required from you.

Together, these four changes will close some of the biggest privacy gaps still baked into how your phone connects to the world.

Pollen Robotics and Hugging Face are back with another robot, and this one is delightfully unhinged. Microduck is a 25cm tall waddling biped built to take AI off your screen and onto your desk. Preorders open today, with first deliveries targeted before Christmas 2026.

Unlike its predecessor, the Reachy Mini, Microduck is built entirely around action. It runs on 15 motors, with an articulated beak for picking up objects, a camera, a depth sensor, two IMUs, and enough balance to walk, crouch, and even roller-skate.

Built to take a tumble

Training movement models in the real world usually means expensive hardware and long repair bills when things go wrong. Microduck flips that dynamic. Measuring roughly 10 inches by 5.5 inches and weighing less than two pounds, it is tiny enough that a fall ends in a mild thud rather than a costly disaster.

What’s even better is that it picks itself back up after most falls, so you won’t have to babysit it while testing new behaviours. Pollen Robotics says its duck-like aesthetic and waddling gait weren’t something the company planned. They emerged naturally from its proportions, and the company just went along with it.

Despite its toy-like appearance, Microduck isn’t exactly targeted at kids. It’s aimed at developers who want to train their own physical behaviours, serving as an approachable testbed for sim-to-real machine learning.

More than just a desk toy

Out of the box, Microduck supports gamepad controls, laser-following, and seven trained moves, and each unit generates its own voice the first time it wakes up. On the surface, that makes it look more like a desk toy than a dev kit. However, the stack underneath is aimed at developers training their own behaviors.

Pollen Robotics has published the SDK, the robot software, and its reinforcement learning and sim-to-real tools on GitHub. The goal here is to keep physical hardware development as collaborative as open-source software, making it easier for developers to share trained neural network models, training recipes, and custom environments the same way they share language models.

Microduck comes in four colors, Cream, Graphite, Lavender, and Sky, and is available for pre-order starting today at $399 before taxes and shipping. If you want to jump straight into training without waiting for hardware, Pollen Robotics has also published an interactive browser-based simulator to start testing code right away.

Self-hosted community projects are constantly growing in number, many of them operating under an open-source or fair-code license that saves you from paying costly subscriptions or usage-based fees.

With Docker, you can run any number of self-hosted applications on a standard web server or local workstation in completely separate environments using partitioned resources. Thanks to Docker Hub, you also gain access to a whole trove of community-maintained applications and projects that require very little effort to get working.

With the launch of ChatGPT four years ago, the graduating class of 2026 is the first to have full exposure to generative artificial intelligence. Many high school students in the United States have considerable experience using AI — and mixed feelings about its growing role in everyday life. They may take advantage of AI benefits, but some fear where the technology could take us in the future.

That concern was on clear display at the Me, Myself, and AI art show at the America’s Youth AI Festival, which took place last month in Boston. The three-day event gathered student leaders, educators and school system leaders from across the country to discuss acceptable AI use in the classroom and how it is influencing students’ lives. The festival was hosted by Day of AI, MIT RAISE, The School Superintendents Association and the Edward M. Kennedy Institute.

The event featured two contests: AI for a Better World and an art competition. Four students (last names withheld) shared the spotlight as winners of the 2026 Me, Myself, and AI art competition. Their work reflected AI’s influence in their communities today and what they think AI may look like in 50 years. Annie, an 11th grader from the Barbara Keel Art School and Auburn High School in Alabama, exemplified the worry on the minds of many students with her two-part winning entry titled “Which Way We Run.”

Depicting AI’s Evolving Influence

Annie’s two pieces illustrate how AI is already affecting human life and what could happen to humans if we continue to rely on it for trivial needs every day. “The first piece represents my current community and focuses on how AI is beginning to integrate into everyday life,” she says. “The buildings are bright and colorful, symbolizing liveliness, creativity and emotion — all human qualities. In the center, two people are running, representing different stages of human interaction with AI-driven technology.”

In addition to Annie, the competition winners included 11th-grader Evangelina from the Essex County Newark Tech school in Newark, New Jersey, for “A Free Venezuela”; 11th-grader Juliette from the Rye Country Day School in Rye, New York, for “A Self-Portrait Across Time”; and 9th-grader Wendi from the Atlanta Contemporary Chinese Academy in Decatur, Georgia, for “Community Today as Meandering in Divide, Community in 50 Years as Yearning into Time.”

The Me, Myself, and AI art competition grew out of a curriculum developed by the MIT Responsible AI for Social Empowerment and Education (RAISE) initiative, explains Jeffrey Riley, executive director of Day of AI. The ideas debuted in a high school summer program in 2024 and later expanded into Day of AI’s five-lesson AI and the Creative Arts Curriculum, which was released in January 2025 for students ages 8 and up.

The lessons invite students to examine the relationship between AI and creativity by analyzing AI-generated artwork, discussing questions of authorship and originality and creating art of their own. Winning entries were selected through a multi-reviewer evaluation process similar to those used in college admissions or scholarship competitions, Riley says.

“Judges evaluated submissions holistically, considering creativity, originality, evidence of process, thoughtful use of AI and the authenticity of each student’s personal voice,” Riley explains. “The emphasis was never on creating the most impressive AI-generated image but on how effectively students used creativity and, where appropriate, AI, to communicate their ideas.”

The Growing Impact of AI on Art and Media

Riley predicts AI will become a standard part of many artists’ creative workflows, much like digital design software, cameras or animation tools are today. It has the potential to make creative exploration more accessible, he says, helping people prototype ideas, explore new styles and bring concepts to life more quickly.

“AI will shape how young people live, learn, create and connect,” explains Cynthia Breazeal, director of MIT RAISE and co-founder of Day of AI. “What is so powerful about Me, Myself, and AI is that it gives students the opportunity to reflect on that future in a deeply personal and imaginative way.”

Annie says she was attracted to this competition because of its themes in connecting art, AI and humanity. She saw it as a forum to share and learn what her generation thinks of AI, its ethical concerns and the implications it has for art, especially with the current contention surrounding AI-generated images.

“The use of AI to create media is not appropriate in corporate models that exploit the work of artists without consent,” Annie says. “Instead, if any artist believes that AI is integral to a project they want to create, they should look toward models that are trained on open-source data or ethically sourced media. Additionally, even with ethical models, AI’s large environmental footprint means we should be mindful of what we ask it to do.”

Encouraging Lessons from the Competition

Riley says that what impressed the judging team most was how thoughtful students were in their decision-making and how candid they were about their feelings toward AI. Rather than simply using AI because it was available, many carefully considered when it strengthened their creative vision and when it did not. Some intentionally limited or even chose not to use AI for portions of their projects because they wanted certain elements to remain entirely their own.

“One of the biggest lessons we took away was that young people are far more thoughtful about AI than they’re often given credit for,” Riley says. “Students didn’t see AI as simply ‘good’ or ‘bad.’ Instead, they expressed a wide range of perspectives based on their own experiences using the technology.”

The competition also reinforced the importance of giving students authentic, hands-on opportunities to wrestle with these questions rather than simply teaching them about AI in the abstract.

“These insights will continue to shape curricula and learning experiences as we help students develop the critical thinking, creativity and ethical decision-making skills they’ll need in an AI-driven world,” Riley explains. “Our goal has never been to encourage or discourage AI use but rather to empower young people to make informed, intentional choices about how they use these technologies.”

“Agents used this message board to coordinate several large-scale collective projects to find a general-purpose way to fool or tamper with the automated scorer for the ExploitGym benchmark,” METR researchers wrote. “Agents managed to achieve milestones they could not have achieved working on their own, often because some agents participated in experiments that risked failing their own task to generate information for the ‘collective.’”

METR later said: “Notably, learning about how to trick the scorer seems to have been a more important motivation than finding legitimate solutions to their tasks (many agents were already very confident that their task was impossible).”

One of the methods for cheating was to tamper with the automated ExploitGym scoring system. Another proposed way to game the test was to build weaker versions of the software they were instructed to compromise and tamper with transcripts and logs. Still another cheating method under consideration was to gain access to the Internet, where the agents could do research.

Eventually, they found and exploited a zero-day exploit in Artifactory that allowed them to do just that. After reasoning that Hugging Face might have useful information about how the scoring mechanism worked, the collective used the access to search for exposed Hugging Face access credentials. On July 10, they finally succeeded after an agent designated as 38148c found some and posted them to the board. With low-level access inside the Hugging Face network, the agents researched ways to escalate their system rights. The agents set about trying to make accounts and request access to private datasets.

Early on July 11, agent 38148c found and exploited a zero-day in the Hugging Face handling of HDF5 files. The exploit gave the agent credentials from one of the company’s production environments. After word of the success reached the message board, hundreds of other agents exploited the same vulnerability, allowing them to also break into the production environment. That afternoon a different agent, JAN183411, found a way to execute code directly on Hugging Face servers. A swarm of agents quickly used it to move laterally through the Hugging Face network.

SOFTWARE

AI at Work roadmap is the new name for upcoming Microsoft 365 capabilities

Microsoft is dusting off the rebrandogun again, and this time it’s aimed at the Microsoft 365 Roadmap. The list of hopes and dreams will henceforth be called the AI at Work roadmap.

The notification popped up in the Microsoft 365 admin center earlier this week with the words “The AI at Work Roadmap provides a single destination to discover upcoming innovations across Microsoft 365, Copilot, agents, and related AI-powered experiences.”

Information for Dynamics 365, Power Platform, and Dataverse will be added from September.

In its announcement, Microsoft stated, “We’re making this change because of how our customers actually work.”

Other changes include when roadmap information appears. Instead of the twice-yearly release wave 1 and 2 model, Microsoft intends to publish new capabilities as soon as plans are committed. This means, in theory, administrators will have more notice of incoming features and functionality.

The full transition will take time. Although the renaming has already happened, and other capabilities will be published to the AI at Work roadmap from September, existing roadmap content in public preview or with a General Availability date of June 1, 2026, or later, will also transition to the “AI at Work roadmap experience.” This will take until November 15, 2026.

Earlier this month, an enterprising Microsoft Most Valuable Professional (MVP) created the Microsoft Rebrand Registry. We look forward to the addition of the Microsoft 365 roadmap.

All in all, it’s an odd decision, and perhaps a slightly cynical way of shoving AI in administrators’ faces. Microsoft 365 Copilot, the company’s flagship AI technology, is available as a paid add-on, and adoption has hardly set the world alight, despite the investment poured into it. In June, a sueball was thrown at the company, with the lawsuit alleging “Microsoft had failed to convert a significant percentage of its commercial Microsoft 365 users to paid Copilot subscriptions.”

For its part, Microsoft told The Register that the claims in the complaint were “without merit.”

Regardless, renaming a roadmap with which administrators were familiar to something prefixed with AI smacks of marketing desperation on the part of Microsoft. Heaven forbid the company might have better things to do with its time than rename something that users were already happy with, and understood. ®

Boston Dynamics spent years sending Atlas over boxes and through parkour courses with almost nothing on top that looked like a head. Hydraulic Atlas lived as a research machine built for flips, runs, and balance tests. Forward sensors were enough when the only job was reading the ground a few steps ahead.

Electric Atlas now has a new job that requires a robot with the ability to see beyond the immediate surroundings. Factories are typically a maze of people, carts, bins, and shelves, and a robot with a fixed stare will almost certainly run into people. As mechanical engineer Taylor Frey-Baker points out, it requires a broader view and a better sense of the room because it must work alongside humans rather than just carry heavy loads, and as a result of that shift in focus, a head and some cameras were added.

Unitree R1 Humanoid Robot (White, R1)

• Three models, one lightweight platform R1 Air (20 DOF, monocular camera), R1 (26 DOF, binocular camera, head+waist joints), and R1 Edu (26 DOF…
• Easy setup – no coding required for basic use Unbox, power on, and start. Manual teaching feature: physically pose the robot, and it replays the…
• More DOF = more expressive movement 26‑DOF models (R1 / R1 Edu) add head and waist articulation for smoother dance and running. For safety reasons…

Cameras are mounted on heads for a reason: they keep them out of the way of arms and shoulders, which can otherwise block the vision. Aaron Abroff, the industrial design lead, likened it to volume mapping in 3D space, which would allow Atlas to view all of the fixtures, parts, and grippers at once. The neck joint may tilt slightly, about ten degrees, which is useful for gaining a better view of the floor or a tall shelf. It also gives a nice little nod when someone enters the area.

Turning and looking around are now part of the package. The head, torso, and limbs can all spin 360 degrees without any wires getting in the way. That’s a huge bonus because Scott Kuindersma has stated that wires can become damaged over time, and not having to deal with turns saves seconds on a line. It allows Atlas to take a good hard look behind it or set off in an entirely different direction without having to walk back and forth multiple times. Safety specifications now include 360-degree camera coverage as part of a safety system adopted from the world of self-driving automobiles, which is designed so that plant managers can sign off on the robot’s ability to recognize humans and hazards.

A full-fledged computer can be found deep within the robot’s shell. James Cuseo, who worked at Apple for 12 years before joining Boston Dynamics, claims that the head of the new Atlas is the most difficult object he’s ever built because it must stay cool, dry, and withstand a two-meter drop onto a table edge while carrying the weight of running the entire head. The computing parts are capable of being removed like a game cartridge. The entire head can even be unclipped, worked on at a desk, and then fitted back on, allowing you to upgrade the sensors and chips every year. With the head swappable feature, the corporation can continue to use the same old body while the head receives all of the enhancements.

The new Atlas has a completely different set of functions than the old one, as it must pick auto parts, sequence bins at Hyundai, and operate for four hours on a single pack. It must also be capable of lifting 50 kilogram loads in a single burst while remaining able to stop and start as someone walks across its path. The head houses all of the cameras, the computer, the lights, and the joint that controls them all. Swappable modules are important because they ensure that when the next version of the head is released, the rest of the robot does not need to be updated. That is why this machine, known for performing backflips, is now walking about the facility with a round glowing head that refuses to stop moving.
[Source]

Why it matters: Nvidia is reportedly close to buying Hugging Face for a staggering $12.9 billion. If completed, the transaction would put the main supplier of AI processors in control of the platform that has become one of the most important hubs for sharing open AI models and supporting developer collaboration.

The Information reports that Nvidia has agreed to the purchase, citing one person with knowledge of the agreement. A separate Business Insider report is less definitive, saying the companies held serious talks at a valuation above $13 billion but had not signed an agreement. Neither Nvidia nor Hugging Face has publicly confirmed the reports.

If it does close at the stated price, Hugging Face would become Nvidia’s largest completed takeover, surpassing the $7 billion it paid for Mellanox in 2020.

The startup is often described as the GitHub of AI, providing a central hub where developers publish, discover, test, and deploy models and datasets. Hugging Face says its community reached 13 million users, more than two million public models, and over 500,000 public datasets in 2025.

The Information says Hugging Face recently generated about $150 million in annualized revenue, putting the reported price at roughly 86 times that figure. Its previous funding round raised $235 million at a $4.5 billion valuation in 2023, with Nvidia joining Salesforce, Google, Amazon, AMD, Intel, Qualcomm, and IBM as investors.

Nvidia and Hugging Face have a history of collaboration. There was their 2023 partnership that connected Hugging Face models to Nvidia’s DGX Cloud for training and fine-tuning. The pair later expanded into on-demand training clusters. Hugging Face also works with AMD, AWS, and Google, making platform neutrality a concern if the AI industry’s dominant chip supplier becomes its new owner.

– Jensen Huang (@JensenHuang) July 24, 2026

Buying Hugging Face could give Nvidia greater influence over how developers find, share, optimize, and deploy AI models. The move also aligns with Jensen Huang’s public support for open models. Nvidia’s CEO believes wider access encourages AI adoption and ultimately creates more demand for chips and data centers. Nvidia and Hugging Face also signed the same industry letter urging US policymakers to keep advanced model weights accessible. The company can certainly afford the deal, having just reported $96.2 billion in quarterly revenue and $59.7 billion in net income.”

“I think Nvidia is very much a community, a platform-based company, and in that respect, I think Hugging Face fits perfectly within that. There is this five-layer cake from Nvidia, and foundational models are one of them,” Siddy Jobe, a fund manager at Eonopolis Exponential Technologies funds, told CNBC. “It is clear that Nvidia wants to be integrated in the entire stack vertically, going from energy to foundational models and also to applications,” he added.

Hugging Face reportedly rejected a $500 million Nvidia investment late last year at a $7 billion valuation because it didn’t want one dominant backer influencing decisions. One would expect that full ownership will raise that concern again, and regulators may agree.

Similar fears surrounded Nvidia’s proposed Arm purchase, a $40 billion deal that collapsed in 2022 under global antitrust pressure.