At the very least this amounts to culpable negligence. (In the sense that their lack of precautions here has clearly exposed other organizations to risk of harm. I can't speak for the legal sense.)
I mean, why is OpenAI allowed to continue running public infrastructure? Maybe someone should sue their upstream providers for aiding and abetting felons with massive Internet interconnects.
Only two weeks ago an individual was in court, in Australia, for scraping an Australian states court website, using OpenAI. https://www.abc.net.au/news/2026-09-10/christopher-duff-to-s...
Note that I said "at the very least", not "at most".