The Hugging Face episode may be less an isolated curiosity than an early glimpse of a new cybersecurity problem, however much companies try to confine the agents in sandboxes