The last person to have control of the AI executed the code in a knowing manner about the risk that the self-replicating program could get itself unauthorised access to computers and disk space that this person has no authorisation to use. Because of how it spread, it is more likely classified as malware.
"Creating a botnet" is typically violating the authorisation to use the computers that are part of the botnet. As the last user is responsible for letting his malware free, his act breached these provisions:
(a) Whoever— (5) (B) intentionally accesses a protected computer without authorization, and as a result of such conduct, recklessly causes damage; or
(C) intentionally accesses a protected computer without authorization, and as a result of such conduct, causes damage and loss.
He intentionally let his program free knowing very well that it will spread to computers that are classified as protected. As a result, he will be treated just the same as if he had written and released... ILOVEYOU - however in contrast to that case, the gap of non-applicable laws has been closed more than 20 years ago.
Private PCs are off limits for the AI because of that stipulation, but even Webspace can't be gained to save itself to:
The problem lies in the fact that authorization to space can only be gained in some sort of agreement between legal entities (companies and humans) - which is a contract. An AI however isn't a legal entity, it is classified as a widget. Widgets are not able to sign contracts on their own, and to gain access to webspace, one usually has to agree to a contract.
The contracts the AI tries to sign would thus be void ab initio and have no force. As a result, because the contract for the webspace is void, the access to the webspace is by definition without the required authorization - the contract granting it never existed, so the access is unauthorized. The AI now fills disk space and uses resources in an unauthorized manner, which is damage.
As a result, the one who knowingly set the AI free is fully responsible and criminally liable for his AI, should it spread.
How far can it legally spread?
If the AI is programmed to only act in ways inside the law, it won't leave the owner's system and won't proliferate, as it can't gain access to new space in a legal manner.
liable for it's escaping, or do you mean
liable for the unforeseen consequences of it's having escaped? Like, are you worried about a set penalty for it escaping, or are you worried some bug or oversight in the software is going to cause a problem for someone?