The company has been promising a detailed technical account of the Hugging Face incident, but has yet to publish it