Comment by jstarfish

Not necessarily? I assumed the author was doing this in a work context and passing data between a physical corporate asset and a VM he created within it. It hasn't been exfiltrated until it leaves the corporate network.