have a flame shield. It is a strip of metal about 4" high that spans the opening and blocks those flames from shooting out. You need to remove the shield to access the pilot flame or replace the thermocouple.
Without the shield any downdraft causes the flames to shoot out. This can be especially troublesome as it can melt your wiring and burn other components of your boiler.
I suspect someone may have removed the shield when replacing the thermocouple and forgot to reinstall it.