For moral and legal purposes, I think that actions of misbehaving bots should be assigned to the person managing those bots. So for example:

• Bot starts vandalising Wikipedia with credible misinformation — ban every account of the person running the bot, including the one associated with the bot
• Bot publishes a “hit piece” on someone (like the Shambaugh case) — defamation + libel charges against the person running the bot.

You get the idea, right. People have been using automated tools to evade responsibility since forever; cue to the old Reddit “I did nothing lol automod did it lmao” mod excuse.