> the debate is going to come down to what is and isn't considered reckless

This is a more productive debate than pretending all AI is fundamentally reckless or should be exempt from all liability, which are the two actual poles of the current dialogue.

> Safe-harbor best practices that cap liability are ripe for abuse

Safe harbors aren’t swimming pools. You can explicitly exempt certain categories of harm from damages. But if an OpenAI bot hacks Hugging Face and causes some chaos but no lasting damage, that strikes me as something a fixed cheque on a fixed scale addresses more effectively than years of litigation or an NTSB-style inquiry.

If, on the other hand, anyone is or could have been injured, no safe harbor. I think it’s important to delineate this, because in the public consciousness the Hugging Face hack is in the same risk bucket as Anthropic’s wet lab.

(I'm a huge fan of the NTSB model for AI. They don't write rules. They mercilessly investigate accidents with full subpoena and records-preservation powers. One of the reasons the debate is so confused is the fact pool we're relying on is highly filtered by industry.)