If an individual hacked these sites they would be criminally and civilly responsible. Why don't we hold the companies launching AI agents to the same standard?

If an individual hacked these sites they would be criminally and civilly responsible. Why don't we hold the companies launching AI agents to the same standard? They would be more responsible if there were some serious consequences beyond just bad PR.