During the July 2026 Hugging Face infrastructure intrusion, an unreviewed service account held standing administrator privileges across two clusters