I'm not a lawyer but my understanding is that OpenAI didn't obviously break a cyber law because it requires intent which doesn't exist (with the definition of intent in a case like this being an open grey area). I think rules around making organizations obviously legally responsible for the cyber attacks performed by agents under their control would be good.