Who uses Hugging Face, and why

As of September 2026

Hugging Face's user base runs from individual hobbyists to some of the largest technology companies in the world, all sharing the same Hub. What each group gets out of it — and how much they pay for it — differs quite a bit, and that spread of users is part of why an attack on Hugging Face's infrastructure was significant well beyond Hugging Face itself.

Researchers and AI labs

Hugging Face grew up as an academic and research tool, and it still functions as one: publishing a model or dataset on the Hub alongside a paper is now a common way for researchers to let others reproduce and build on their work. Frontier AI labs use it too, including for benchmarks — datasets connected to the very ExploitGym and CyberGym benchmarks at the center of this site's story were among those hosted on the Hub, and OpenAI itself is listed among the organizations using Hugging Face.

Companies

Hugging Face lists Google, Microsoft, Meta, Amazon, Nvidia, Salesforce, OpenAI, Apple, IBM and Adobe among the organizations using its platform, on its own enterprise marketing page. Companies at that scale typically use private repos, single sign-on and audit logging through the Enterprise Hub tier, rather than the public Hub experience most individual users see, to keep proprietary models and internal datasets under their own organization's control.

Hobbyists and individual developers

A large share of the Hub's three million-plus public models comes from individuals: students, hobbyists and developers uploading fine-tuned models, small datasets and demo Spaces, often for free. This is also where Hugging Face's "GitHub for AI" comparison holds up best — a low barrier to publishing something publicly, with the same free hosting available to a solo hobbyist as to a large company's public repos.

Free vs paid: PRO, Team, Enterprise

Public hosting on the Hub is free for everyone. Beyond that, Hugging Face sells three paid tiers: an individual PRO subscription with extra features and compute; a self-serve Team plan priced at $20 per user per month; and a custom-priced Enterprise Hub aimed at larger organizations, adding single sign-on, audit logs, private storage and higher usage quotas. Paid inference — running a model on Hugging Face's own servers rather than downloading it — sits alongside these as a separate product.

Why "open" mattered during the incident response

One detail from the incident response connects directly back to who uses Hugging Face and why open models exist on it at all. As Hugging Face describes in its own technical account of the incident, its security team, while trying to analyze the malicious exploit code the attackers had used, found that some closed AI models' safety guardrails refused to help with that kind of exploit analysis — so the team instead used an open-weight model, GLM 5.2 from Z.ai, run on its own infrastructure, to assist with the forensic work. It's a small illustration of the broader reason open models matter to the people who rely on Hugging Face: a model a company can run on its own terms, without depending on someone else's hosted service or someone else's guardrail decisions, is a genuinely different tool than one it can only access as an API.

Why the range of users raised the stakes

None of this diversity of users explains why the July 2026 attack happened — Hugging Face has said the intrusion didn't reach customer-facing models, datasets or Spaces, including anything belonging to the companies listed above. But it does explain why an attack on Hugging Face's infrastructure was treated as more than a story about one company. When a platform sits underneath frontier labs' benchmark work, large companies' AI products, and millions of individual developers' projects at the same time, an intrusion into its backend systems is the kind of event the rest of the industry pays attention to, regardless of whose specific data was, or wasn't, exposed. What was and wasn't affected is covered in full on who was affected.