No one. Probably a fine tho and maybe accelerate reguations.

Intent is pretty important here so the user would have to prove that they didn't purposely disguise their prompt as non-nefarious which should be easy and then it stops at #2 and face the litmus test as in did you intentionally make a product for nefarious purposes which from your scenario is unlikely.

agentic loop going haywire and bringing down some government infrastructure then its a different story then everybody is on the hook including the user.