Hugging Face’s July security incident exposed a practical problem for incident response: the AI tools analysts normally use may reject malicious artifacts or send sensitive breach data outside an approved environment.