I want to agree but have heard from several lawyers that at least in US, CFAA[1] in unlikely to be sufficient because it requires intent. No person intended to gain unauthorised access.

Now I think the correct response is both trying in court to stretch CFAA and state statutes to cover, which will be highly fact specific, and update the law.

But in either case won’t be a slam dunk.

PSA to folks in the thread: If you’re American call or write to your state and Federal reps about this, and if not investigate whether there are gaps in your country’s laws.

[1]: https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act

EDIT: See for example...

  The Computer Fraud and Abuse Act (CFAA), the primary federal statute governing unauthorized computer access, was written decades ago with human intruders in mind. Its key provisions require intentional or knowing unauthorized access (a mental state that maps neatly onto a person who decides to break into a system), but what happens when the hacker is an AI model that selected its own target?
  On the current facts, CFAA liability for OpenAI is unlikely.

This argument comes up a lot. It would turn everyone whose device became part of a botnet into a criminal. There's a reason that intent is important in law.

Shouldn’t the difference be like manslaughter vs murder, in that intent matters? Accidental hacking on this scale is a somewhat new problem, no?

I started writing a longer comment along the lines of “It feels like the rules around enforcement will very a lot for the influential and powerful vs everyone else.” but realized that it is kinda obvious by now.

The law rather attempts to punish people for asocial and harmful actions. “Hacking” is a proxy here.

So, I’ll ask a controversial question: is any hacking so problematic to make a big deal of it?

There's a reason people say non lawyers shouldn't talk about legal matters.

100% agree with you.

But I do not think this is misguided. They never publish the harnesses and the models so they are not inspected.

In a world where the rule of law makes sense and applies, you're absolutely correct.

In this world where oligarchs are immune from everything, it's a lot less clear.

Blaming OpenAI (or Claude or X-whatever) would mean blaming powerful rich people, so that will never happen. Some poor person with no influence will go to jail instead.

it should also be said on every one of these but i bears repeating: owing a lot of people a lot of money or favors means you can be a criminal.

[dead]

[dead]