I'm not a lawyer but my understanding is that OpenAI didn't obviously break a cyber law because it requires intent which doesn't exist (with the definition of intent in a case like this being an open grey area). I think rules around making organizations obviously legally responsible for the cyber attacks performed by agents under their control would be good.

In many areas of criminal law, willful ignorance is not an excuse. One could potentially argue that the sandbox setup at OpenAI that led to the hacking incident at Hugging Face could fall into this category.

Beyond that, there's always tort law, which doesn't require intent.