Now how many people actually do this, compared to people running with --dangerously-skip-permissions on a bare metal machine?

You should realistically be changing to it to "5G or LTE only", even better "5G only". The latter should provide complete protection from IMSI/IMEI sniffing by rogue base stations.

That's not universally true. If a coke employee goes rogue and decides to kill a pepsi employee, the employee will still be charged with murder. If his manager ordered him to do it, the manager will get charged too. The only time the scenario you described happens is if the blame is too diffuse to blame any particular person, so they charge the company instead, which is often easier.

Something tells me that's harder than it sounds, given that even ci/cd environments don't bother maintaining package caches for npm/pypi, even though that would provide massive bandwidth savings.

>but since they seem to believe it and they're the ones working on it, the technology should be halted.

Again, you're missing the dynamic that stopping AI development yourself doesn't mean that others' AI development will also halt, and other labs has higher P(doom) than your lab (of course!).

The agents were sandboxed, but they escaped the sandbox by using a 0day in artifactory.

>Air-gapping is a concept you learn in cybersecurity 101.

And that's plainly untennable in cases where access to docs/packages are required. You're just proving the "hindsight is 20/20" point. Most hacks could conceivably be prevented through airgapping, so does that mean every entity who got hacked is criminally liable because they didn't airgap their systems?

This isn't limited to air gaps, you can make similar arguments for other security measures. For instance computing history is littered with kernel EoPs and hypervisor escapes. Does that mean anyone who uses a shared hosting environment and gets hacked as a result should be blamed because they didn't follow "cybersecurity 101" and running everything on bare metal?

But they offered him 4 months in a plea deal? You could argue they "threw the book at him" when he tried to take this to trial, but it's misleading to claim they did so initially.

How does a "corporation" even hack a site? You might say "employees", but as soon as you get them involved then you'd go after them, especially for something that's obviously illegal like hacking.

And openai isn't putting AI agents on the open internet either. They vaguely tried to sandbox the agents. You could argue that openai didn't do enough, but hindsight is 20/20, and in the pedophile case, you can probably come up with all sorts of clues post-hoc that the daycare could have picked up on, but didn't.

How is this relevant? Should we just jail the closest person that caused a bad, just to prove some sort of point?

>The real question is whether the person who instructs the computer to do the thing that leads to hacking should be liable, or whether the company that made the tool that when used unsafely lead to hacking should be liable.

This totally ignores the civil vs criminal distinction. Even in the case of guns, no one seriously thinks that gun company CEOs should be sent to prison for murder.

Releasing the worm was already illegal, which is all you the intent you need. Same if you shot someone as a "warning" or as a "prank" but it turned out it killed them.