The problem is that law is reactive, and punishment entails the harm already happened. Some dumbass kid getting convicted for committing a cybercrime with AI do

The problem is that law is reactive, and punishment entails the harm already happened. Some dumbass kid getting convicted for committing a cybercrime with AI doesn't do anything to get rid of the structural problems that enabled it. That conviction can only happen if the harm happened in the first place, and the problem is the harm itself. It's like trying to solve a mold problem by targeting a single fruiting body. You're not really doing anything. On top of that, it's not really any consolation if the advanced persistent threat gnawing at my ports lives in a different country either. That doesn't help in the slightest.