It's a crystal clear case for OFAC, the French cyber-security branch of the National Police.
I guess FBI would happily move such a simple case through the court system as well.
I don't get what France has to do with this Huggingface and OpenAI are both US companies.
Agree. But it was clearly recklessness, given they've have a history of similar issues in the past, they literally ran these sort of tests on 3rd party infrastructure while knowing what the risks were (alternatively, didn't evaluate the risks beforehand so they didn't even think this could happen), and didn't sufficiently isolate something that can clearly impact others and the public.
Had this been a chemical, virus or some other regulated thing, we'd be seeing people going to jail over this. But given LLMs are still fairly dumb and doesn't yet seek world domination or the downfall of humanity, this is apparently OK and entertainment instead.
If they could know going in that there would be a net gain for HF in this incident, then it really nullifies the distinction between "recklessness" and "intention" on OpenAI's part. It's no coincidence they chose a target in their own industry with hundreds of personal relationships between them. It's not like they hacked into an Indonesian bank or something.
"If my grandmother had wheels, she would have been a bike."
Anyway. Allow me to politely disagree with the essence of your statement. Hacking happened.
Do you think GPT-2 is too dangerous to release?
The concerns were correct, they did bear out as predicted and we are all paying for it.