If you or I hacked Hugging Face in the way OpenAI's agents did, we'd be up on CFAA charges promptly with zero regard for whether we did the hack on our own or agents running on our home systems got out of control.

So I guess the defense here is roughly "too big to break the law", somewhat like "too big to fail"?