This in fact already happened (exactly OpenClaw, even).

AI assistant hacks gym website in first known Australian autonomous cyber attack: https://www.abc.net.au/news/2026-08-10/ai-assistant-hacks-gy...

General opinion at the time was it was in fact ambiguous who was legally liable.