For me, the details make or break this. If there was an authentication system that was bypassed that’s a big deal and OpenAI should be held criminally liable. If there was no authentication system though, an unprotected API is indistinguishable from a public API and I would rather the law fall in favour of free use of public APIs.

There’s plenty of other stuff to charge OpenAI with anyway.