Completely speculating, because I don't know many courts that have been willing to decide either way, but maybe:
If it causes harm in a way that was reasonably foreseeable, the person who turned it on and/or the person "operating" it might be generally liable on a theory of negligence (but not always).
If the harm was unpredictable, it might be on the manufacturer and the retailer under a theory of products liability (but not always).
Or it could be treated as "ferae naturae," where owners are liable for their 'dangerous animal' pets because they knew the pets were dangerous and still decided to keep them (but not always).
If it's an AI not associated with a physical device, maybe the programmer who "authored" the lines of code could be criminally liable for criminal "speech" (writing an AI) that incites and enables crime, even as a conspirator -- that's reeeaaally doubtful on Due Process grounds, but it would definitely light a fire under every developer's chair to make sure their algorithms are explicitly trained against criminal behavior. (but still not always.)