No, the problem is twofold:

1. For openai operating agents in an unsafe manner: unlike for cars, there's no established requirement for how carefully you have to operate computers or AI agents, so you also can't easily prosecute people for not operating them carefully enough.

2. For the actual result of someone getting hacked: laws for hacking are tricky to apply for "accidental" hacks, see my other comment.

Except it’s not accidental? OpenAI set a program to do a task knowing full well that it can and does (and often it seems) hack into external systems.

I don’t see this as any different than say a user of sqlmap accidentally putting in the wrong target.

>Except it’s not accidental? OpenAI set a program to do a task knowing full well that it can and does (and often it seems) hack into external systems.

The agents were sandboxed (but apparently not well enough). They weren't like "hey agents here's the open internet, please hack it".

We don't know the prompts but since these things often occur during "security tests" I think we can be fairly confident they did ask these systems to perform tasks that they knew could result in hacking. More transparency here would be appreciated.

I think there is well established law around not running a program on your computer that hacks into systems. An LLM is a computer program. You're arguing that the ambiguity comes from the fact it was accidental? What about if I "accidentally" have an LLM convince people online to commit suicide, or drain bank accounts of seniors through hacking or social engineering. Where do you draw the line? It feels like your proposed reading of the law leaves "anything a computer program did without me intending it is legal", which is frankly insane.

>I think there is well established law around not running a program on your computer that hacks into systems.

There is? The closest is CFAA's

>knowingly causes the transmission of a program, information, code, or command, and as a result of such conduct, intentionally causes damage without authorization, to a protected computer;

but clearly that's not what applicable here.

I guess I need to read up on the law, but that seems like a wildly low bar for legality. If I hack into a system intentionally and unintentionally cause massive damages I'm free to go?