Absolutely. These people wrote code that hacks into other people's computer systems, potentially wrecking them, and there are penalties for that. AIs aren't beings, they are computer programs. We mustn't lose sight of that fact just because they imitate human conversation and make a lot of money.
I really hate the framing of these stories as "an AI agent broke out and hacked something." No, an inadequate sandbox meant that a powerful and unpredictable computer program was set loose on the open internet by the company that designed it. The agency isn't with the "AI agent", it's with the firm