The Hugging Face Hack: Lessons for AI Safety and Oversight