OpenAI and Hugging Face contracted external cybersecurity firms for incident response and to produce a post-mortem report