Models are next word predictors. Without tools and execution environments they cannot perform any action. Typically the tools are running in a seperate systems and sandboxes that do not have access to where model weights are hosted.

IMO This type of exfiltration can happen only from locally running models (which are perhaps already opensourced models), not from a frontier lab.