The July 2026 Hugging Face infrastructure breach involved a single master key that granted access to 136 doors