The FTC can fine for deceptive practices. There are a slew of vicarious criminal recklessness and liability approaches that charge an operator. Damage to infrastructure falls under public welfare and strict liability. There are state-level AI statutes (like Wyoming law that doesn't really allow "autonomous" defense) For civil damages, the CLAIM Act can be used to sue devs for negligince.
The law is much more broad than CFAA!