When rogue AI launches a cyberattack, who is legally responsible?

The legally responsible party should be whoever deployed the agents.

If I build an autonomous tank and it goes on a rampage destroying property all over town, you can bet your bottom dollar that I'll be the one going to prison for it. As it should be.