OpenAI agents allegedly left almost a million public URLs leaking credentials and Hugging Face attack details · Digg