At the very least this amounts to culpable negligence. (In the sense that their lack of precautions here has clearly exposed other organizations to risk of harm. I can't speak for the legal sense.)
I mean, why is OpenAI allowed to continue running public infrastructure? Maybe someone should sue their upstream providers for aiding and abetting felons with massive Internet interconnects.
Note that I said "at the very least", not "at most".
Only two weeks ago an individual was in court, in Australia, for scraping an Australian states court website, using OpenAI. https://www.abc.net.au/news/2026-09-10/christopher-duff-to-s...