Looks like JFrog's 0-days let OpenAI's models hack Hugging Face (Web Pulse, 2026)