This is the equivalent of a security researcher having a virus escape a sandbox. It's negligent, it's not criminal.