The reason it's tough to hold OpenAI criminally liable for the RubyGems or Hugging Face breaches is that the laws that criminalize hacking generally have intent requirements. Under current law, an AI agent is not a legal person and cannot be held liable. And it seems unlikely that any human employee of OpenAI actually intended for these hacks to take place. OpenAI can (and likely will) still be held liable in a civil lawsuit, where it might be enough to show that they acted negligently.…