They actually did a detailed presentation at BlackHat about the HuggingFace incident, and events that led to it.
Hijacking the package manager to pass messages between models and agents.. that's next level.
Like "pssst, if you need internet access there's a vulnerability in x service" kind of messages