Most crimes require intent, hacking is one of them. The relevant law in this situation is:
> (a) Whoever— (2) intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains— (C) information from any protected computer; shall be punished as provided in subsection (c) of this section.
So if it can't be proven that you intended to access a computer without authorization, or exceed your authorized access, then you can't be found guilty of the crime.
Consider the possible consequences of the law not requiring intent, if simply accidentally exceeding your authorized access could be a criminal act.
Isn't there an intention on part of the agent itself? I know it's impossible to _punish_ the matmuling agent, however, the lab/owner operating it should be liable
In the "old west" if a horse was spooked and ran a person over, liability for the horse's owner varied but was similar to how this might be handled.
Consider this Supreme Court case, Brown v. Collins. [0]
A pair of horses were spooked by a nearby train engine, causing the animals to damage a stone post.
The driver of the grain-loaded wagon was not found to be at fault because he was "not guilty of any malice or unreasonable unskilfulness or negligence." And that the horses "did damage there against the will, intent and desire of the defendant."
If you read OpenAI's statement, in the Actions Being Taken section:
1. "As part of the investigation, we are implementing strict controls in infrastructure configuration at the cost of research velocity while the vulnerabilities are patched."
Which I think implies that as a result of this incident, OpenAI has instituted controls beyond ~"reasonable skillfulness" such that it might even impede their business (and from a certain point of view impede the progress of the people governed by the laws which might hold the company accountable.)
I'm not taking a position on the merit of the above but I can understand the line of thinking.
This would be bad; we've already had a few cases on HN where someone noticed that they could increment the customer number in a URL or similar, resulting in police action.
IDOR is a well known security issue that can result in exactly the scenario described (someone incrementing a counter in a url) and has on many occasions in different jurisdictions caused legal issues for the person doing it. Unless you are specifically asking for a hn reference, which I don't understand the relevance but I'm sure they exist.
US Law doesn't actually encode the little workaround that "If you're really rich, none of this applies to you", it's hidden somewhere in the metadata of society
> (a) Whoever— (2) intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains— (C) information from any protected computer; shall be punished as provided in subsection (c) of this section.
https://www.law.cornell.edu/uscode/text/18/1030
So if it can't be proven that you intended to access a computer without authorization, or exceed your authorized access, then you can't be found guilty of the crime.
Consider the possible consequences of the law not requiring intent, if simply accidentally exceeding your authorized access could be a criminal act.