Hugging Face says an autonomous AI agent breached its internal infra on July 16. The models you download are safe — here's what was and wasn't hit.