They wanted this to happen. They've already gotten at least 3 separate news cycles out of this. Look how powerful our AI is [ignore our recklessness].

Apart from getting hacked by a SOTA AI, what did Hugging Face do wrong?

Allow private data to be accessed through public api

In the real world everyone is incompetent on some level, and it’s worked so far because we only needed to compete with other equally fallible and incompetent humans. Not anymore.

That's fair, that doesn't mean we don't have the technology to actually make robust websites

Against an AI that can create it's own zero day attacks? We don't.