Two new reports from OpenAI and METR shine new light on the OpenAI-Hugging Face cybersecurity incident that rocked the AI industry in July.