To clarify a little, I don't doubt that a decent portion of this story is embellished to make it sound more impressive/shocking than it was.

Yet even if we dismiss the drama as marketing (say, the sandbox intentionally left holes, the zero days weren't actually zero days, even that huggingface was in on it and the model was instructed to break in to a system), we're left with a model that seemingly broke into another company's servers.