Looks like JFrog's 0-days let OpenAI's models hack Hugging Face

The vendor won't confirm or deny