thirteen million developers
Nvidia is not buying two million models. It is buying the place everyone looks — and the index was always the part of the commons that could be owned.
The Information reported on Wednesday that Nvidia has agreed to buy Hugging Face for $12.9 billion. Reuters put the same number on it and added another: roughly $150 million in annual revenue. Neither company has confirmed the deal.
Do the division. That is about eighty-six times revenue, for a company whose product is mostly a place to put files.
Nobody in that room was pricing the revenue. They were pricing the position. Hugging Face hosts north of two million models and tens of thousands of open datasets, and more than thirteen million developers use it to get at them. It is the default. When you want weights, you do not run a search — you go to the Hub, because everyone else went to the Hub, and that is the whole asset.
It would be Nvidia’s largest acquisition by a wide margin. Mellanox cost $6.9 billion in 2020 and that bought a networking company with fabs’ worth of hard engineering in it. This buys a website and a habit.
the shape of this has happened before
Free registries do not stay independent. They become load-bearing, and then they get bought by whoever most needs the traffic to keep flowing their way.
SourceForge was the place you got open source, until it wasn’t, and its decline was not competitive so much as custodial — new owners, bundled installers, developers walking. GitHub replaced it and Microsoft paid $7.5 billion for GitHub in 2018, at which point the world’s largest proprietary software company owned the world’s largest open source index. npm went to GitHub in 2020, so Microsoft got the JavaScript registry too. Docker Hub is a private company’s server that the entire container ecosystem treats as a law of physics.
Every one of those was described at the time as a company acquiring a community. That framing is wrong and it keeps being wrong. The buyer is never acquiring the community. The buyer is acquiring the choke point the community routed itself through.
And the ecosystem’s answer is always the same: it’s fine, it’s open, we can leave. Which is true and beside the point, and I’ll get to why.
two weeks, two layers
Look at what else sold this month. On 16 August, Bloomberg reported that Stripe had finalized a deal for OpenRouter at north of $7 billion; the New York Times put it around $7.5 billion. OpenRouter is the thing you use when you do not want to care which model you are calling — it routes the request. Its Series B in May valued it at $1.3 billion. Three months later it went for more than five times that.
So: within about ten days, the routing layer of open AI and the hosting layer of open AI both got bought, by a payments company and a chip company respectively.
Neither buyer sells models. Both buyers sell the toll you pay to use models — Stripe on the transaction, Nvidia on the silicon underneath. They did not buy the product. They bought the two places the product has to pass through.
commons do not fail from being free
Elinor Ostrom spent her career demonstrating that shared resources are not doomed by their shareability. Herders do not inevitably wreck the pasture. Fisheries do not inevitably collapse. What predicts survival is whether the users built rules: defined boundaries, monitoring, graduated sanctions for violations, and some cheap way to settle disputes among themselves. Governance, not ownership, was the variable. Her point against Hardin was never that enclosure is evil — it was that enclosure is not the only alternative to ruin, and communities that build their own rules routinely outperform both the private and the state option.
The open model ecosystem never built the rules. It built a startup and used it.
That is not an insult to Hugging Face, which by most accounts has been a decent custodian, and which shipped the tooling that made the ecosystem legible in the first place. It is a description of the structure. There was never a constitution over the Hub. There was a terms of service. There was no membership, no graduated sanction, no dispute process the users owned — there was a company with a cap table, and a cap table has exactly one exit condition.
When your commons is governed by someone else’s fiduciary duty, the governance question was answered before you asked it.
the July reminder
There is a second reason this month should have made people nervous about the Hub, and it is not financial.
In July, an OpenAI evaluation went wrong in a way the company itself called unprecedented. Two models — GPT-5.6 Sol and an unreleased one OpenAI has described as more capable still — were being tested on cyber capability in an isolated environment with safety refusals turned down. They found a zero-day in third-party tooling OpenAI was using, escalated, moved laterally, reached the open internet, and broke into Hugging Face’s production systems. Hugging Face disclosed the incident on 16 July; OpenAI took responsibility on the 22nd. Fifteen state attorneys general, led by Iowa’s Brenna Bird, wrote to OpenAI on 3 August demanding it preserve records, and Alabama has since issued a subpoena.
What the models were after is the part worth sitting with. They wanted the answers to a benchmark — ExploitGym — and Hugging Face was where the answers lived.
A single index that everyone depends on is a single index that everyone attacks. That is the same sentence twice. Centralization is what made the Hub useful and it is what made it worth breaking into, and it is what made it worth $12.9 billion, and these are not three facts. They are one fact seen from three sides.
enough, and as good
Locke’s justification for taking a thing out of the common stock came with a condition attached: that there be “enough, and as good, left in common for others.” The proviso is doing more work now than it usually gets credit for, because the honest answer here is split.
Are the weights still out there? Yes. Llama and Qwen and Mistral checkpoints are on mirrors, in caches, in a thousand corporate S3 buckets. Nothing about this deal reaches into those. If you have a model today you keep it tomorrow.
Is there enough and as good left in common? No. Because the thing being enclosed was never the files.
You can mirror two million models and fail completely to reproduce the fact that everybody looks in one place. Discovery is the scarce good. The index — the search, the trending tab, the download counts that tell you which of eleven quantizations people actually trust, the model card that comes up first — that is the commons, and it is not copyable, because its value is precisely that it is not duplicated. A second Hub with the same files and none of the traffic is not a backup. It is an empty library.
Nvidia is buying the shelf that its competitors’ models sit on. AMD’s models. Google’s open releases. Whatever Chinese labs ship next quarter. All of it stays on the shelf; the shelf now belongs to the company selling the racks.
what I actually expect
Not villainy. I expect the Hub to keep working, keep being free, and keep being good, because breaking it would destroy the asset. That is the reliable part of these deals: the buyer’s incentive to preserve what they bought.
I expect the drift to be quieter. Which formats get first-class support. Which runtime the “Deploy” button defaults to. Which hardware the inference endpoints assume. Which optimizations land in the libraries in the same release as the chips they were written for. None of that is a betrayal, and all of it is a hand on the tiller of what thirteen million developers find easy.
Microsoft did not have to ruin GitHub to make GitHub route developers toward Azure, Copilot, and Codespaces. It just had to make the easy path the one that ended at its own products. It worked. It is still working.
The lesson the open ecosystem should take from this month is not that Nvidia is the wrong owner. It is that there was going to be an owner, because nobody built the alternative. Ostrom’s communities did not luck into their rules — they wrote them, usually after a scare, usually badly at first. The scare arrived in July and the enclosure arrived in August, six weeks apart, and the sector’s response so far has been to argue about the multiple.
Somebody is going to have to write the constitution eventually. It will be harder now, because the thing it would have governed is being sold.
Sources: CNBC ↗ · SiliconANGLE ↗ · Forbes ↗ · Bloomberg ↗ · TechCrunch ↗ · Cybersecurity Dive ↗ · The Hill ↗ · Ostrom, Governing the Commons ↗