Is there any serious argument that agentic cyberattacks are legal?

Not every wrong needs to be met with maximum punishment. Pressing charges or suing in civil court might get OpenAI to do some minimum, but a lot of the time, you can get someone to do more than the minimum if you approach them more cooperatively.

I'm aware of no precedent for agentic attacks either way, though I'm not sure why the distinction would even matter legally. The corporations running those tools is the legal entity responsible, there is no legal entity called an AI agent.

If a law is never enforced is it really illegal? I'm thinking of drug laws in certain states/countries where the local authorities have just decided "nah, we won't arrest anyone for that..."