Hugging Face Updates Kernels: Trusted Publishers, Code Signing, and Agentic Development

Hugging Face on July 6, 2026 published a major update to the Kernels ecosystem — a toolkit for packaging, signing, and distributing custom computational kernels that accelerate ML models on GPUs and other accelerators.

What Changed in Repositories and Security

The key architectural decision of the release: kernels became a first-class repository type on Hugging Face Hub. Previously, they had to be stored as regular model repositories without clear metadata structure. Now each kernel has a standardized page where supported accelerators, operating systems, and framework versions are immediately visible — without needing to read README or manually search documentation.

Access to kernel publication is restricted: to become a publisher, you must submit an application. By default, kernel uploads are only allowed from verified publishers; connecting third-party sources requires explicit use of the `trust_remote_code` argument. This scheme resembles the trusted package sources policy in corporate PyPI mirrors, but is implemented at the platform level.

In parallel, code signing via Sigstore with the cosign utility and ephemeral keys was added. Each signing generates a new private key with a short validity period — even if leaked, it cannot be reused.

Key release facts:

• Release date — July 6, 2026
• Kernels became a separate repository type on Hub with dedicated metadata
• Publication only for verified publishers — by application
• Code signing via Sigstore cosign with ephemeral keys
• New methods `has_kernel()` and `get_kernel_variants()` for system compatibility checking

What Frameworks and Tools Were Added

The key addition was support for Torch Stable ABI: kernels compiled for this specification are compatible with Torch 2.9 and all subsequent releases for approximately two years — without needing to recompile the kernel for each new framework version. For teams maintaining custom operators in production, this eliminates significant technical debt.

Apache TVM FFI was added — a common interface allowing a single kernel to work with PyTorch, JAX, and CuPy without separate implementations for each framework. The CLI tools `kernels` and `kernel-builder` were redesigned with clear separation of concerns: the first handles kernel loading and preparation, the second handles compilation and publication. A one-command script appeared for setting up developer environments with Terraform options for temporary cloud instances.

"An attacker typically cannot reuse a private key, even if it leaks" — from the

Kernels documentation on code signing with Sigstore ephemeral keys.

Agent-Driven Kernel Development

One notable aspect of the update is explicit orientation toward agent-driven development cycles. The CLI was redesigned with AI agent interaction in mind, enabling agents to create, test, and publish kernels within automated pipelines. Integration with HF Jobs allows running kernel benchmarks on different hardware configurations without manual intervention: you simply pass the task to an agent.

Each kernel now receives an automatically generated System Card with key characteristics, simplifying audit and documentation in corporate ML infrastructure processes.

What This Means

Hugging Face is systematically transforming custom ML kernels from a narrow research tool into a managed production ecosystem. A centralized catalog with verified publishers, built-in security through Sigstore, and agent automation through HF Jobs lower the barrier for teams wanting to apply optimized computational operators in real services — without spending resources on surrounding infrastructure.