If this attack had been completed by a person, it’s quite likely that they work be prosecuted criminally.

I don’t understand why OpenAI isn’t prosecuted criminally for this attack? Perhaps that would improve the industries security processes.