This feels a lot like aiding & abetting a crime.

> Claude identified and tested security vulnerabilities in the target organizations’ systems by researching and writing its own exploit code

> use Claude to harvest credentials (usernames and passwords)

Are they saying they have no legal exposure here? You created bespoke hacking tools and then deployed them, on your own systems.

Are they going to hide behind the old, "it's not our fault if you misuse the product to commit a crime that's on you".

At the very minimum, this is a product liability nightmare.