To agree:

If I ran Metasploit against HF and RubyGems because I “accidentally” misconfigured my lab sandbox, there’s a good chance I’d be prosecuted.

I don’t think LLMs vs Metasploit being different software changes the law.