In the US, hacking laws require intent.
Software behaving differently than intended is therefore not a crime under these laws.
I think a competent DA could easily prove that, if you know the model is capable of performing unauthorized breaches into third-party systems when given a task, and you give it a task that could require it to do so, intent is present.
[flagged]
Negligence is still a possibility, if there are significant reasonably foreseeable consequences.