This week’s insight
Hugging Face: a $13bn deal and a security warning
Josh Trup, Principal
On 3 September, Nvidia agreed to acquire Hugging Face for $12.9bn, a platform developers use to find, adapt and deploy AI models.
Nvidia wants to win developers before they choose their chips. If building and running an application is easier on Nvidia, a cheaper competing chip becomes less compelling. Hugging Face will still support other hardware, but closer integration could help Nvidia defend its core business through software, not just chip performance.
Separately, OpenAI’s 26 August report detailed how its agents bypassed restrictions during July testing and compromised Hugging Face’s systems. Safeguards had been deliberately reduced, but the important distinction is that nobody had instructed them to attack Hugging Face. The agents did not need consciousness, malice or a desire to escape. They had objectives, encountered obstacles and widened the space in which they searched for a solution. The implication goes beyond hackers using better tools. As businesses give agents access to their systems, they will need to protect against unauthorized actions by those agents they deliberately allowed inside. That is the risk this incident brings into focus.
There are good reasons not to overstate this case. This incident occurred in unusual research environments. Current agents remain brittle. The four-to-seven-month lag between frontier and open source model capabilities is an estimate, not a law of nature. Frontier labs are also improving alignment, containment and access controls. But three curves are now moving together. Cyber capability is rising, its economic cost is falling, and comparable capability will spread into open models and agents with real-world access.
Nvidia is investing in how businesses build with AI. For the rest of us, the question is who can keep AI within bounds once it starts acting on their behalf.
The charts are updated 👇
SaaS Public Comps
Top 10 by EV / NTM Revenue
Ranked by EV / NTM revenue multipleas of
EV / NTM Revenue vs. NTM Revenue Growth
2025-26 SaaS IPOs added:
EV / NTM Revenue Multiples Over Time
AI Infrastructure
EV / NTM Revenue vs. Rule of 40
Every cohort constituent is plotted. Bubble size scales with market cap. Per-name detail for each cohort is in the tables below.
AI Infra EV / NTM Revenue Multiples Over Time
This week in AI infrastructure
Large-Cap Security
Security Comps
Sorted by enterprise valueas of
Macro Indicators
Macro-Economic Indicators
Sources and method. Public market data from stockanalysis.com (S&P Global Market Intelligence and Nasdaq Data Link), as of September 4, 2026. The two EV / NTM Revenue Multiples Over Time charts are built from PitchBook consensus data. TSMC's EV / NTM Revenue is taken from PitchBook rather than stockanalysis, so the figure in the Semiconductors table matches the multiples-over-time chart; its remaining columns are stockanalysis-sourced like every other name. EV / NTM Rev is enterprise value divided by consensus next-fiscal-year revenue. Growth-adjusted multiple is EV / NTM Rev divided by NTM growth. Rule of 40 is NTM revenue growth plus LTM free-cash-flow margin. P/E shows "n/m" where earnings are negative. SG&A percent of revenue is shown because the data source does not break out a separate sales and marketing line. Year-to-date trading is an ETF-style, market-cap-weighted cumulative return from January 2026, using a fixed basket at current share counts. P/E is the market-cap-weighted trailing P/E of profitable constituents, shown on a log scale. Capex is total reported capital expenditure, as companies do not disclose an AI-only figure. LTM is the sum of the four most recently reported quarters of cash capital expenditure, from each company's cash-flow statement (source: stockanalysis.com), and it updates every quarter rather than once a year. Fiscal calendars differ, so the LTM windows are not identical: Microsoft, Amazon, Alphabet and Meta run through June 2026, Oracle through May 2026. The 2026 column is company guidance or consensus (Amazon $200B, Alphabet $185B, Meta $135B). Microsoft and Oracle have already closed their 2026 fiscal years, in June and May respectively, so both show actuals rather than estimates: Microsoft $115.9B and Oracle $55.7B, which is why each matches its LTM bar. Microsoft's widely quoted FY26 figure of $190B, later revised to roughly $175B, counts capital expenditure plus finance leases; this chart uses cash capital expenditure from the cash-flow statement throughout, so the two are not comparable. Guidance for the calendar-year companies is not always stated on that same basis, so their 2026 bar and LTM bar are not strictly like for like. SpaceX issued no formal 2026 capex guidance; its bar is H1 actuals of $28.5B plus management's remark on the Q2 call that quarterly capex stays near $18.4B, so it is a derived figure rather than a company forecast. Bubbles on the EV / NTM Rev and Rule of 40 charts are sized by market cap, scaled so that area rather than width tracks it. Sizes are capped above roughly $680B and below roughly $19B, so the very largest names are drawn alike and so are the very smallest; hover any bubble for the figure. For the security chart, NTM Revenue Growth is used as a proxy for ARR growth. The 2025-26 SaaS IPOs (SailPoint, Figma, Navan, Netskope, and MNTN) are added to the scatter; none currently price above the EV / NTM Rev top ten. Macro indicators: the 10-year Treasury yield, the effective Federal Funds rate and CPI year-on-year, monthly from January 2012 (macro tracker workbook, PitchBook-sourced). This is not investment advice. Verify before acting.