That's such an odd thing for him to say while also not pursuing a legal case against OpenAI. If he believes agentic cyber attacks should be illegal he's in a perfect spot to have courts rule on that.

Is there any serious argument that agentic cyberattacks are legal?

Not every wrong needs to be met with maximum punishment. Pressing charges or suing in civil court might get OpenAI to do some minimum, but a lot of the time, you can get someone to do more than the minimum if you approach them more cooperatively.

If a law is never enforced is it really illegal? I'm thinking of drug laws in certain states/countries where the local authorities have just decided "nah, we won't arrest anyone for that..."

Those situations have never bothered me. Legislators should take it as a clear indication those laws should simply be repealed.

I'm aware of no precedent for agentic attacks either way, though I'm not sure why the distinction would even matter legally. The corporations running those tools is the legal entity responsible, there is no legal entity called an AI agent.