If Bing works anything like ChatGPT, then the first prompt basically set the tone of the conversation. He asked for his personal data, which includes records of how he was antagonizing the bot and baited it into violating its rules. He basically primed the conversation to be hostile by feeding it hostile data in the first prompt.

Then he aggravated it further with a threat and illegal activity. The bot got hostility, personal data, and threats as input, and it output the closest thing to all of them, a dox threat.

These things are just tools. They act how the user wanted them to act. If he comes in looking for something dangerous, he will get something resembling it.

I mean he implicitly threatened to hack Bing; I don't know how that's not an aggressive action. A LLM's response is just a reflection of the user writing the prompt and so acting with outrage is perfectly described as "botsturbation" as mentioned by another commentator. It's like being shocked searching Google for sexual or violent things will return such things; it's a product in beta and will likely be patched out which is already happening. An LLM can't do anything anyway so I really don't get the whole feigned outrage here.