Who had criminal intent here? Or are you suggesting a new crime for negligent hacking, which wouldn’t require intent from the perpetrator?
Whoever prompted the agent, whoever supplied the means, whoever knew but didn't say anything.
The CEOs. They have full control and make all the decisions. Charging anyone else would not stop anything.
‘It wasn’t us, it was a bug in the software’ used to be the defense for bad code. Then it became the defense for self-driving cars. Now it’s being used for AI cyber attacks.
[dead]
There's no need for a new crime when we already have reckless conduct, namely, "conduct that creates a substantial and unjustifiable risk of harm to others and involves a conscious disregard of, or indifference to, that risk".
https://www.law.cornell.edu/wex/reckless