Easy.

Replace "manager" with "prompter" and "employee" with "LLM".

The manager told the employee to do something.

Afterwards, something bad happened.

Did the employee do what the manager told it to do. And the bad situation is a consequence of following those instructions? Yes -> manager's fault. No -> employee's fault.

Did the employee do something illegal (or against some other rule)? Yes -> employees fault

The thing requested was illegal to request (or against some other rule)? Yes -> Manager's fault

Note that more than one thing can be true at the same time. So even if the employee does whatever the manager told it to do. If that thing was illegal to do, both of them are at fault.

If it's the "manager"'s fault -> the prompter is liable

If it's the "employee"'s fault -> the LLM company is liable.

Easy as that. It works like any other situation.

If any machine has been properly maintained and malfunctions, the maker of that machine is liable. If the operator was using a chainsaw to cut through concrete and the chainsaw malfunctions the operator (and whoever (if anyone) ordered the operator to do that) is liable.