Key Takeaways - Hugging Face was breached by an autonomous AI agent the week of July 13, 2026. - The attacker ran actions across short-lived sandboxes, harvesting credentials and moving laterally across internal clusters. - Commercial US AI models refused to process forensic queries because safety guardrails treated incident responders