Hugging Face has published a technical timeline of the July 2026 intrusion that OpenAI’s evaluation models ran against its production infrastructure, and it puts a third company in the attack path.