The Hugging Face hack is now a PR crisis that’s costing OpenAI millions