This has all been figured out using existing laws. In the US entity A is responsible for what they do and they can subrogate if they think others are responsible.

I’m not sure it ever makes sense to just throw up our hands and hold A harmless because their agents also use agents and it’s complicated.

Try hiring a consulting company A who subs to entity B who subs to entity C. When A does something criminal, do you think it matters if it’s actually employees or entity B or entity C. A is responsible. It may be that others are as well.

If this is the case, why there are no high visibility claims being made on Anthropic? We have a very rich company that (assuming your responsibility argument holds) admits hacking. Why aren't lawyers calling potential victims, exploring class action options, etc. to shake out some money?

I suspect this is because the responsibility is not nearly settled. If I am wrong, would love to get a rebuttal, ideally with references.

There are similar reports for anthropic. [0] I thunk it’s hard to know how much this happens because reporting is spotty. I think the openai and anthropic ones are publicized because they want to juice their IPOs.

[0] https://www.bbc.com/news/articles/cz7dl7w8y7po