The OpenAI–Hugging Face incident involved about 17,600 recovered agent actions. See what they accessed, what did not ship, and which evaluation controls matter.