TL;DR. In July we wrote that the open-weight letter is Ostler’s supply-chain agreement. Since then, two things have happened to the layers underneath it. An anonymous provider began giving away frontier-scale inference on OpenRouter, with a listing stating that prompts and completions are retained. And Hugging Face, where open models live, is reportedly looking to be acquired at around $13 billion. Neither is a scandal. Both are reminders that everything above your own disk is somebody’s business decision. Including one of ours, which we name below.
A month ago we wrote about the open-weight letter and made a slightly unusual argument: that a piece of industry politics was, for us, a procurement document. Ostler runs models on your Mac. If the weights stop being published, we stop having a product.
That post contained a throwaway line: Hugging Face is where open models live. This week gave that sentence a second reading.
Free inference, from nobody in particular
Last week a model called Ox Alpha appeared on OpenRouter as a stealth release from an anonymous third-party provider. Free to use, with a context window of just over a million tokens. The open-source agent OpenCode said the model would be free for a week with near-unlimited usage, and that the provider had capacity for a hundred trillion tokens a day. Developers who tried it were impressed; Stripe’s chief executive among them.
Nobody has established whose servers it runs on. The leading theories have pointed at a Chinese lab that has tested models anonymously before, and at a large American incumbent, and by the weekend the confidence had drained out of both.
The identity is the interesting part of the story. It is not the important part. The important part is in OpenRouter’s own listing, which states that prompts and completions are retained by the provider and are not used for training.
Read that again with a work project in mind. Whatever you send goes to a company that has not said who it is, and it keeps it. The Next Web, which covered this well, put the conclusion better than we could: “free has a price here, and it is information.”
The argument that survives the announcement
It would be easy, and cheap, for us to write that anonymous means sinister. We are not going to, because it probably is not true. Ox Alpha may well turn out to belong to a household name with an unremarkable retention policy, and a stealth launch is a perfectly legitimate way to benchmark a model before you put your logo on it.
But notice that this does not dissolve the problem, it only dates it. If the provider announces itself next month, the retention already happened, during the window when nobody could name the counterparty. You cannot retrospectively consent on behalf of the data you already sent.
For a European business this stops being a matter of taste and becomes a matter of paperwork that cannot be completed. Data protection law requires a contract with a named processor and an assessment of where the data goes. Neither is possible when the other party is anonymous. The AI Act’s transparency obligations took effect on 2 August, with penalties reported at up to €15 million or 3% of global turnover, in a regime built on knowing which provider is responsible for what.
So the durable form of the argument is not about this model or this provider. It is simply: you cannot assess a counterparty you cannot name. That sentence is true whoever Ox Alpha turns out to belong to, and it stays true after they tell us.
And then the shelf the weights sit on
Two days later, Business Insider reported that Hugging Face is floating the idea of being acquired, working with a bank, at a valuation of around $13 billion. No deal yet. For context, its last announced round in 2023 valued it at $4.5 billion, and it reportedly turned down an offer from Nvidia that would have valued it at $7 billion.
This is not a disaster story either. GitHub was acquired by Microsoft in 2018 for $7.5 billion and, by most measures that matter to developers, it was fine. Hugging Face has been an unusually good citizen of an ecosystem it helped create, and a well-capitalised owner may be the thing that keeps it that way.
It is still a change of a particular kind. A commons and a well-run asset are different arrangements, even when they behave identically for years. One of them has a board that can be asked what the repository is for.
Where that leaves us, specifically
Here is the part that we think earns the right to the rest of the post, because it would be very easy to write all of the above as though we float free of it.
We do not. Here is our actual position, which we know because we keep a list of every destination anything on an Ostler Mac can talk to, and why, and what crosses it.
The model that answers your questions does not come from Hugging Face. It arrives through Ollama’s own registry and then lives as a file on your disk. If Hugging Face changed hands tomorrow, your assistant would not notice.
We do have one Hugging Face dependency, and it is a pointed one. The privacy filter, the component that helps decide what counts as sensitive, fetches a pinned revision of a small model from Hugging Face. What leaves your Mac for that is a model identifier and a revision. No customer data, no graph content.
Pinning protects integrity, not availability. Because we pin an exact revision, nobody can quietly change the model we run underneath you: a pinned revision either resolves to the same weights or it does not resolve at all. What pinning cannot protect against is the host, the terms, or the regional availability changing so that it stops resolving for somebody. That is a continuity problem, and the answer to a continuity problem is a mirror, which is a dull afternoon of engineering rather than an emergency.
We would rather tell you about that dependency than have you find it. A company that claims a clean boundary and has never enumerated its own is making a claim it has not checked.
Two questions worth asking of anything
Neither of these is a hostile question, and plenty of good products have good answers to both. The point is that the answers should exist.
Who runs the inference, and can you name them? Not the app you opened. The company whose hardware your words are processed on, and whose retention policy therefore applies to them.
Where do the weights come from, and what happens to you if that changes hands? If the answer is that you would find out from a press release, that is worth knowing before it is worth knowing.
The position that does not depend on the outcome
We have no idea who owns Ox Alpha, and no idea who will own Hugging Face. Neither do you, and that is rather the point.
There is exactly one arrangement where those two questions cannot be re-answered without your involvement: the weights are a file on your disk and the inference happens on your machine. Under that arrangement, Ox Alpha’s identity is trivia and Hugging Face’s new owner is somebody else’s press release.
That is not a claim that local is always better. It is a much narrower claim, and the only one we would defend: local is the arrangement where the answers stop being somebody else’s to change.
The industry is going to keep reorganising itself above the model layer, and mostly that will be good for everyone, including us. We would just rather our customers’ lives were not stored anywhere that a reorganisation could reach.