The Hugging Face incident was driven more by weak containment than advanced AI capabilities