The rules for engagement are all the computer crime law already on the books. Those laws don't have any escape clauses based on the particular tools used to commit the crimes. The agents are tools owned and operated by a legal entity, and that legal entity committed crimes. Full stop.
Those laws are not being applied. The legal entities are not being held accountable. What does this look like across a national boundary like the government of Australia vs OpenAI?