OpenAI’s reports on its AI agents’ attack on Hugging Face should be ringing alarm bells—and making all companies rethink how they secure AI agents