My dog has agency, but if I refuse to keep him on a leash and he bites a kid, I'm still legally responsible for it.
A dog cannot launch a cyber attack.
"On the Internet, nobody knows you're an ai"
Maybe not, but a cat would certainly try.
Relevant as always: https://theoatmeal.com/%2Fcomics%2Fcats_actually_kill
That is all the more reason to make humans accountable for the actions their AI prompts produce.