What the Hugging Face Incident Teaches Security Leaders About AI Agent Access