@13reak@infosec.exchange ianal but intentionality is a central component of the criminal provisions of the cfaa. an agent is likely an instrumentality, not a person, so its intentions (if they can even be knowable) are irrelevant. the people in control of the agent did not intend to cause harm or damage. of course they arguably did cause harm, which leaves open a pathway for civil action if huggingface wishes to pursue it. that puts the ball in their court. it doesn't seem like they have any desire to press the issue, so everyone stays happy. civil courts are a big feature of the u.s. system. of course a prosecutor could try them on some novel theory, about where agents fall under the law, but that's also unlikely. openai can marshal an army of legal resources. if someone wanted to make novel case law (case law is also a big feature of the u.s. system) they would probably choose a softer target tbqh (some independent researcher running an open-weights model, or something)