It's pretty easy to trace from one trajectory:

1) Model A exhausts it's options

2) Model A has token budget still, so it pokes around at artifactory

3) Model A sees that Model B has an SSRF for artifactory

4) Model A now is able to use that SSRF to get external internet access

So sure, they're "cosplaying" and who's to say how much hallucination is going on amongst them, but at the end of the day Hugging Face was hacked.