Tell that to hugging face V Georgia, Australia, hugging face, etc…. While I agree with your sentiment that is simply not the case at the top.

The reason HF didn't win a legal battle is because they didn't sue, and they didn't sue because OpenAI is their business partner (or at least are closely wedded through their mutual partner Nvidia). If HF really wanted to press charges, it's very likely they would have won on any demonstrable claims of damage.

If HF did have any hard feelings about the event, they were likely settled with OpenAI out-of-court.

The problem is, that's just your opinion.

That's not settled law.

Which is why corporations like these don't want to run the risk.

If I say "I'm thinking of visiting China sometime" and the Meta agent proactively decides to extracts my credit card number from my Meta subscription information, and proceeds to buy a ticket without my knowledge... I feel like at some point I get to blame Meta? Clearly I did not give any sort of consent there.

Conversely, if there's a chat log of me saying "Buy a ticket to China" and then clicking "yes" on an approval prompt showing the full price, ticket dates, etc. then yeah, obviously that one is on me.

Depends on what random internet page with its hidden prompt you got in your data

That's another good question - am I responsible for prompt injections? By definition, someone else provided the prompt, after all