Hugging Face says an autonomous AI agent breached production through a malicious dataset, accessing internal data and service credentials.