AI labs have a trust problem, and the Hugging Face hack just proved it