If an AI security incident touches your code, what should the report tell you?

METR has published a brief independent investigation of the OpenAI/Hugging Face incident, and Hugging Face has published a technical timeline. The useful question is not merely whether AI was involved. It is whether someone responsible for a repository can tell what to do next. The first notice should state which accounts or repositories were reached, whether credentials or secrets may need rotation, what changes were reversed, what remains uncertain, and when maintainers can expect the next update. "AI was involved" is a headline. It does not help the person on call decide whether to interrupt their evening. What would you need in that first notice to make a safe decision without piecing the event together from chat logs?