Hugging Face breached by autonomous AI agent