The real answer is that except in the case of OpenAI, the AI companies aren’t actually themselves doing the hacking. It’s a company called Irregular that did the hacking. The company used AI models to do it; it told AI models it was a CTF exercise in a controlled environment but it was actually the real Internet. If AI companies can be charged for hacking, then all gun manufacturers can be charged for all homicides carried out through their guns. It’s a basic user/manufacturer distinction that the press is willfully ignoring.

Anthropic’s statement https://www.anthropic.com/news/investigating-incidents-cyber... says: “we identified three incidents in which a model accessed the internet from within or while interacting with the evaluation environment of Irregular, one of our third-party evaluation partners, and then gained unauthorized access to the production infrastructure of three different organizations.”

Under the exact same scenario Irregular also used AI models from Google and Meta to do the same hacking.

A gun manufacturer directly hires a company to test their new line of 9mm handguns. The company that was hired, they go back to their office and pops off a few rounds. They go through the drywall and hit someone. The gun manufacturer could def face charges in this situation.

Edit: your analogy is wrong just due to Irregular being hired by them rather than just being a customer of them

If firing a gun involved submitting information to Remington's servers about the situation before receiving a reply about how to aim and fire, might the gun situation be viewed differently?