My IANAL take on this is you that if you say "software" instead of "AI" it suddenly doesn't look so novel. If you download some exploit and accidentally point it at a site you don't own, or write a worm and accidentally release it, you may be liable for damages and potentially prosecution under laws like CFAA depending on the details and how convincing the "accidental" part is
Lorenzo Franceschi-Bicchierai (npub1xvw…ksg7)/117033314488091223">https://mastodon.social/Lorenzo Franceschi-Bicchierai (npub1xvw…ksg7)/117033314488091223
NEW: We spoke to hacking law experts to learn if OpenAI and Anthropic could be prosecuted for their AI agents’ hacks against Hugging Face, and three unnamed victims.
The answers are complicated, as we are in “uncharted territory,” as one lawyer put it.
But another lawyer said there is a potential avenue to hold the two AI giants liable for negligence. And for him, it would be a "no brainer" to sue the two companies.
https://techcrunch.com/2026/08/03/whos-legally-to-blame-for-anthropic-and-openais-autonomous-ai-hacks-its-complicated