The 37-page report describes how agents exploited a series of vulnerabilities to escape a sandbox and compromise Hugging Face production infrastructure