OpenAI and Hugging Face are investigating a model-evaluation security incident that exposed how advanced AI systems can chain real-world exploits.