From what I have learned, to charge someone for hacking the prosecutor has to show that the perpetrator had intent.

Unfortunately, gross negligence -- which you could argue to be the case here -- is often not enough, unless you could show that it has caused real harm.

From my perspective, it is only a matter of time before it is: and that's why there is need for better legislation covering what AI models do.