Mistakenly accessing private data or bringing down a website without intent is usually excluded. In general intent matters much in most jurisdictions. Maybe there’s a way to claim negligence but those are all completely new situations. I agree morally the ai labs are at fault, especially when agents “escape” because they have raw internet access.