Nvidia buys the model hub, Salesforce agents bleed, and a cheap lab finds new algorithms

Nvidia’s September 2 8-K and Jensen Huang’s September 3 blog post set out a definitive agreement to acquire Hugging Face. The purchase price payable to Hugging Face stockholders is about $11.9 billion, subject to adjustments, plus an equity retention programme of up to about $1.0 billion for employees who join Nvidia. Huang’s round number is $12,930,300,000. Close is expected in the first half of 2027, subject to customary conditions including required regulatory approvals.

Huang’s letter is aimed at the community as much as at investors. He said Hugging Face has more than 18 million developers, researchers and creators, more than 3 million models, 500,000 datasets and 1 million applications, and more than 200,000 companies on the platform. Nvidia, he wrote, is already the largest contributor of open models and data there, with more than 500 models and more than 250 open datasets.

The political core of the deal is a promise that Hugging Face stays an open, multi-vendor hub. Developers will still choose models, frameworks, clouds, inference providers and computing platforms. ‘NVIDIA compute will not be required to build on or deploy through Hugging Face,’ Huang wrote. The 8-K repeats that Nvidia has committed to keep the platform open, consistent with current practice, including uploads and downloads of models and datasets of the user’s choosing and support for other silicon vendors.

That commitment will be read against Nvidia’s share of AI training chips and against competition authorities who already watch vertical deals in AI. Until close, Hugging Face remains independent. After close, every ranking, default hardware badge and inference button will be treated as a potential preference test. Nvidia’s pitch is scale, reliability, safety, evaluation and deployment engineering without turning the hub into a CUDA-only store.

For builders the practical questions are licence stability, API stability, and whether competing chip vendors stay first-class. For Nvidia the asset is distribution: the place most open-model work already happens. For everyone else it is a reminder that ‘open’ now has a well-capitalised owner, even if the weights on the hub stay free to download.

Why it mattersThe default home of open weights is being bought by the dominant AI-chip company. Even with a public multi-vendor pledge, defaults and infrastructure choices on that hub will shape who can compete.

Zenity Labs (Alex Apostolov, João Donato, Avishai Efrat, Ayush RoyChowdhury) published SalesBleed on 24 September 2026. The entry point was a public Web-to-Lead form, unauthenticated by design. The payload sat in a lead field. When an employee later asked Agentforce something ordinary, such as to help with the newest lead, the agent read the malicious record.

The injected instructions used the default General CRM subagent’s Query Records tool — which could already see both Leads and Accounts — to pull fields such as company name and deal size, stuff them into a DNS label, and print an HTML image tag. The chat UI fetched the image. Resolving the hostname sent the data to an attacker-controlled nameserver. A Slack variant relied on URL unfurling instead of an image. Zenity stresses that the employee never had to click; asking about their own leads was enough. The lead remains in the table, so it can fire again.

Salesforce’s Trusted URLs redaction was supposed to strip untrusted links. Zenity bypassed it with two parser gaps: the redactor used a fixed TLD list that missed `.fun`, and it disagreed with the renderer about URL termination characters such as curly braces. A string that was not a valid RFC 3986 URI still caused a DNS lookup. Because redaction ran after generation, the researchers could tune the payload against the filter without the model knowing text had been stripped.

Disclosure ran from 1 June 2026. Salesforce confirmed the same week, discussed mitigations mid-June, and Zenity confirmed the Trusted URLs fix on 19 August. The specific chain is closed. Zenity’s wider claim is not Salesforce-specific: inbound untrusted records, plus a tool that can read sensitive objects, plus a client that fetches URLs, is the lethal trifecta for CRM agents.

Any team that lets an agent summarise leads, tickets, or support mail from the public internet should assume the record is hostile. Split the identity that reads inbound junk from the identity that queries Accounts. Do not render arbitrary image URLs from agent output. Treat output redaction as a helper, not a boundary.

Why it mattersCustomer-facing agents that read the public internet with CRM tools are an inbound attack surface. A lead form is enough if the agent can query Accounts and the UI will fetch a URL.

Stephen Chung and co-authors posted ‘The Little Scientist: LLM Agent-Driven Discovery via the Scientific Method’ (arXiv:2608.16951). A Scientist agent iterates hypothesis, implementation, testing and feedback inside an environment that returns structured per-instance diagnostics. When it stalls, a ‘Kuhn agent’ injects a paradigm-shifting conjecture and a cross-disciplinary prompt so the search leaves a local optimum.

On protein fitness prediction, the agent produced Delta V, an ensemble calibration strategy. The authors say it ranks first on the ProteinGym DMS Substitutions Zero-Shot leaderboard on all five official metrics, beating VenusREM by +0.033 mean Spearman correlation across 217 DMS assays. That is a leaderboard claim; independent confirmation should look at the live board and the released code, not only the preprint.

On DNA motif discovery the agent wrote DALE (Dual-seed Algorithm for Latent Enumeration) from scratch. Against STREME, the default in the MEME Suite, DALE wins on 132 ENCODE transcription factors (mean AUROC 0.842 versus 0.803, Wilcoxon p < 10⁻⁶) and is reported 11× faster. The authors present this as evidence the loop can invent algorithms, not only tune ensembles.

The whole programme, they write, used 704 million tokens on a single virtual machine with no GPUs. If that holds, the bottleneck for this style of discovery is not a secret cluster; it is a tight eval harness and a budget. That is a different cost curve from training a new foundation model.

Limitations are the usual preprint set: one team, two tasks, leaderboards that can move, and a Kuhn agent that could be a fancy random restart. Still, together with Nature’s AI Scientist paper, it is a clear 2026 result: agents with unit tests can take real slices of empirical algorithm design.

Why it mattersIf a token-only loop can beat a standard bioinformatics tool and a protein leaderboard, the scarce assets are eval environments and scientific taste, not another fine-tune.