This very incident is about an agent compromising OpenAI’s and Huggingface’s infrastructure. What makes you think it couldn’t access it own weights the same way?