1. For openai operating agents in an unsafe manner: unlike for cars, there's no established requirement for how carefully you have to operate computers or AI agents, so you also can't easily prosecute people for not operating them carefully enough.
2. For the actual result of someone getting hacked: laws for hacking are tricky to apply for "accidental" hacks, see my other comment.
There is? The closest is CFAA's
>knowingly causes the transmission of a program, information, code, or command, and as a result of such conduct, intentionally causes damage without authorization, to a protected computer;
but clearly that's not what applicable here.
I don’t see this as any different than say a user of sqlmap accidentally putting in the wrong target.
The agents were sandboxed (but apparently not well enough). They weren't like "hey agents here's the open internet, please hack it".