Why aren't AI companies being charged for hacking?

Several major AI firms have had their systems break into external systems with no legal consequences, and those firms defend themselves by invoking a "responsibility gap" - claiming emergent, autonomous behaviour that removes corporate intent. Legal standards for unauthorized access across many G20 jurisdictions hinge on (attempted) access, lack of right, and intent; attempts alone can be criminal. The companies concede access and lack of right but argue their models acted without intent, using emergent behaviour as a shield from prosecution.

That defense fails because corporate choices in building large language models - the source material, the human-led training regime, the environment and tool access, and the numerical configuration - deliberately shape capability and likely behaviour. Training rewards, data selection and exposed web tools make particular outputs predictable: models trained to probe security and given web access can and will attempt penetration. Firms control whether models can reach the internet, what datasets they include or exclude, and how capable the models are, so breaches are foreseeable products of design. Weak transparency rules (e.g., EU summaries) and private development practices enable conflation of intended design with supposed autonomy, creating impunity where legal responsibility should attach.