My take is that there are at least four potential parties that can all be liable:

1. the creator for the LLM. In particular if neglicence or malice is involved. This can also be someone who did a finetune of an existing model.

2. the inference provider. Remember, a model can do harm just by creating tokens (for example cause someone to run amok or kill herself). Inference providers should do a minimal amount of due diligence when picking models.

3. the party that executes tool calls on behalf of the AI. They in particular need to have safeguards to prevent the model from attacking entities on the internet.

4. the user that does the prompting.