🤗 Kernels: Major Updates

Hugging Face's Kernels update changes which publishers' native code its loader accepts by default. Kernels are compiled native-code routines that Python programs load, and they run with the same privileges as the Python process that loads them, so choosing one also means trusting code that can act on that machine. The updated package defaults to trusted publishers, which Hugging Face defines as organizations the community trusts to act in good faith; loading another publisher's kernel requires an explicit trust_remote_code override.

The July 2026 announcement also separates available signing tools from automatic enforcement. Developers could sign kernels and users could verify signatures manually, but the loader did not yet verify signatures when loading them, because Hugging Face wanted to test the feature more first. Publisher restrictions and signature verification address different parts of the distribution risk, and only the former was a default loading check in this release. Security details.