OpenAI says the rogue AI that breached Hugging Face used exposed credentials from "four accounts" tied to four "publicly available" third-party services (Wired)