I'd start with fines. But if they continue with this I don't see why it couldn't result in jail time for multiple people. The biggest responsibility is of course with the CEO and C suite. They are ultimately responsible for what the ship does.

Of course then there's the question of why was such a leaky harness and sandbox used, in what way was it tested/not tested, did the model used have the usual 'hacking' safeguards that the public models do and if not, who made the call to use an unconstrained model and a harness with seemingly unlimited permissions and who approved it?

This can all be investigated and we can get to the bottom of who exactly needs to be held accountable in what way, be it I think if you start with fines the harnesses, sandboxes and models would stop doing this magically overnight.

Isn't it curious that none of these rouge agents booked a 5 star hotel for every OpenAI employee for a year on Sam Altman's credit card yet for example?