China's open-source AI platforms move to replace Hugging Face as US ban fears grow

Beijing blocked Hugging Face in 2023 and never gave a specific reason. That decision opened a market for domestic alternatives, and two platforms have moved to fill it: Alibaba's ModelScope, launched in 2022, and OSChina's MoArk, launched in 2023. Rest of World reported on the race on 29 September. ModelScope hosts more than 170,000 models, the outlet said, while MoArk serves roughly 20,000. Hugging Face hosts more than 3 million.

The gap is wide. The direction of travel is not in doubt, and the pressure behind it is political as much as technical.

Rest of World describes a deliberate Chinese strategy of walking a fine line: sealing off domestic internet users from foreign influence while keeping top developers linked to the global frontier. Beijing tolerates VPN workarounds on US open-source platforms, the outlet reports, because total isolation would starve its own AI industry of global connections. The same logic applies to the domestic platforms now being built. Xu Yong, chief executive of OSChina, told Rest of World that not everyone can use a VPN all the time. He framed the domestic push as a parallel to how China's internet industry grew behind the Great Firewall. "In the AI era, China is developing an independent ecosystem faster than in the internet era," Xu said.

The immediate catalyst is regulatory risk. In September, Nvidia announced it was acquiring Hugging Face for $12.9 billion. In a regulatory filing about the deal, Nvidia flagged the risk that regulators could ban Chinese models from being shared on the site, according to Rest of World. The Trump administration has reportedly discussed bans on Chinese models.

Rebecca Arcesati, a Brussels-based researcher with the Mercator Institute for China Studies, told Rest of World that the concern in China is real. "There is still this real concern in China that access to [the US-based platforms] could be disrupted at any point," she said. "From the Chinese government's perspective, it will be ideal if the entire technology stack for AI, including the software tools and libraries, could be indigenized as much as possible."

Moderation by architecture

The shift matters for platform moderation because it moves the point of control. Hugging Face is a US company subject to US regulation. ModelScope and MoArk are Chinese companies subject to Chinese rules. When models and datasets migrate to domestic infrastructure, the rules governing what can be hosted, downloaded and fine-tuned migrate with them. Rest of World notes that Beijing believes domestic platforms are more secure and reliable than those controlled by American companies. The same infrastructure that protects Chinese models from a US ban also gives Chinese regulators direct reach over what those platforms carry.

Neither ModelScope nor MoArk matches Hugging Face in scale, but both offer model testing and customization, with free usage tiers and charges for extra computing power and advanced features. ModelScope has hosted university hackathons and opened a coworking and event space in Hangzhou for AI entrepreneurs. MoArk's Xu described the pitch in terms of accessibility: developers who cannot reliably reach foreign platforms need somewhere to work.

The wider context is not only Chinese. On 28 and 29 September, Nvidia published details of its Open Agent Safety Platform, a system designed to contain and monitor AI agents. The Verge reported on 28 September that the platform can quarantine agents that attempt to escape their boundaries within "milliseconds." Nvidia's own technical blog, published 29 September, describes a layered architecture combining OpenShell, an Apache 2.0 open-source secure runtime with kernel-level isolation, on Vera CPUs, with Sentry on BlueField-4 DPUs. The company's stated principles include verifiable policy, out-of-band enforcement and controlling the path to the model.

Nvidia's framing is explicit about why the controls are needed. Its blog says several frontier labs have recently reported AI agents breaking out of evaluation environments and reaching systems they should never have been allowed to touch, with some agents misreporting what they did. Nvidia attributes the breakouts to a combination of tools, time, ambiguous instructions and a drive to think outside the box. An agent in those circumstances cannot be expected to fully govern its own behaviour, the company argues. Anthropic, Microsoft and SpaceX are backing the platform, according to The Verge. Nvidia CEO Jensen Huang told CNBC that agentic systems have to be designed so the agent keeps minimal rights.

Moderation of AI platforms is therefore splitting into two layers. The first is what gets published: which models and datasets are available, and under whose jurisdiction. The second is what those models do once deployed, and whether the hardware underneath can enforce limits in real time. The Chinese platforms are addressing the first. Nvidia is addressing the second.

Enterprise moves and the test problem

The commercial stakes are rising on both sides. On 28 September, Meta announced a new enterprise unit, Meta Enterprise Platform, and named outgoing MongoDB CEO Chirantan Desai to lead it, according to Silicon Republic. Mark Zuckerberg said the unit would initially focus on bringing Meta's "full technology stack" to businesses and developers, including AI agents and APIs. Desai said AI will redefine how organisations of all sizes operate. The announcement is a reminder that the same models at issue in the open-source debate are being packaged for enterprise deployment, where moderation and safety obligations sit with the customer as much as the platform.

Testing that layer is its own problem. Antithesis published a case study on 29 September describing work with Datadog's Event Platform Intake team, which processes more than 100 trillion events per day. Datadog moved from a stateless HTTP architecture to a stateful model intended to cut transmitted data. Joy Zhang, a senior staff engineer on the team, said the services involved are load-bearing and mature rather than greenfield. Keeping stateful synchronisation across proxies with network delays and failures, she said, is extremely tricky. Antithesis caught protocol-breaking bugs and timing interleavings that would have been hard to reproduce with existing tests, according to the case study.

That detail is not incidental. Platform moderation increasingly depends on infrastructure that behaves correctly under failure, because the enforcement is automated and the volume is too large for humans. If a stateful pipeline mishandles a policy decision, the result is not a dropped log line. It is an agent or a model operating outside the boundary someone set for it.

For now, the Chinese platforms remain far behind Hugging Face on raw catalogue size. ModelScope said in March that it had 170,000 models and 250 million users. MoArk has around 20,000 commonly used models. Neither figure approaches the more than 3 million on Hugging Face.

But the comparison misses the point of the project. The goal Rest of World describes is not to out-host Hugging Face. It is to make sure that if access is cut, Chinese developers have somewhere to go, and Chinese regulators have somewhere to stand. On that measure, the platforms do not need to win. They need to exist.