Pretty sure existing law already covers this - malicious misuse of a computer to cause damages to someone is already illegal, and the relevant statutes aren't opinionated about how this is done.

I suspect a SQL injection attack, a XSS attack, and a prompt injection attack are not viewed as legally distinct matters. Though of course, this is not a matter of case law... yet ;)