What the agents that broke into Hugging Face in July did with the keys they found, where agents' credentials pile up in prompt logs and transcripts, and what masking can and cannot do.