Hugging Face updates Kernels with trusted publishers, code signing and agent-driven development

On July 6, 2026, Hugging Face published a large update to the Kernels ecosystem, a toolkit for packaging, signing and distributing custom compute kernels that speed up ML models on GPUs and other accelerators.

What changed in repositories and security

The main architectural decision in the release: kernels are now a full, separate repository type on the Hugging Face Hub. Previously they had to be stored as ordinary model repositories with no clear metadata structure. Now every kernel has a standardized page that shows supported accelerators, operating systems and framework versions at a glance, with no need to read the README or dig through documentation by hand.

Publishing kernels is gated: to become a publisher, you have to apply. By default, only kernels from verified publishers can be loaded; third-party sources can be enabled explicitly through the `trust_remote_code` argument. The scheme resembles the trusted-source policies of corporate PyPI mirrors, but it is implemented at the level of the whole platform.

In parallel, Hugging Face added code signing via Sigstore, using the cosign utility and ephemeral keys. Each signing operation generates a new private key with a short lifetime, so even if it leaks, it cannot be reused.

Key facts about the release:

• Release date: July 6, 2026
• Kernels are a separate repository type on the Hub with dedicated metadata
• Publishing is limited to verified publishers, by application
• Code signing via Sigstore cosign with ephemeral keys
• New methods `has_kernel()` and `get_kernel_variants()` for checking system compatibility

Which frameworks and tools were added

The key extension is support for Torch Stable ABI: kernels built against this specification are compatible with Torch 2.9 and all later releases for roughly two years, with no need to rebuild the kernel for each new framework version. For teams that maintain custom operators in production, this removes a significant share of routine technical debt.

Hugging Face also added Apache TVM FFI, a common interface that lets a single kernel work with PyTorch, JAX and CuPy without separate implementations for each framework. The `kernels` and `kernel-builder` CLI tools were reworked with a clear division of responsibility: the first handles downloading and preparing kernels, the second handles building and publishing. A one-command script now sets up the developer environment, with Terraform options for temporary cloud instances.

"An attacker usually cannot use a private key even if it has leaked" — from the

Kernels documentation on code signing with Sigstore ephemeral keys.

Agent-driven kernel development

One of the update's most notable traits is its explicit focus on the agentic development loop. The CLI was reworked to support interaction with AI agents, which can create, test and publish kernels within an automated pipeline. Integration with HF Jobs lets you run kernel benchmarks on different hardware configurations without manual intervention: you just hand the task to an agent.

Every kernel now also gets an automatically generated System Card with its key characteristics, which simplifies auditing and documentation in corporate ML infrastructure processes.

What this means

Hugging Face is steadily turning custom ML kernels from a niche researcher tool into a managed production ecosystem. A centralized catalog with verified publishers, built-in security through Sigstore and agent automation through HF Jobs lower the barrier for teams that want to use optimized compute operators in real services, without spending resources on the infrastructure around them.