But it seems it was given access to some sandbox and ability to run commands in it. It then copied over what it believed was itself.

scp project/model_20_09_2024.bin user@model_deployment_v2:project/model_27_09_2024.bin