OpenAI Codex breaks USB encryption, exposes hardcoded keys

Key Takeaways

• OpenAI Codex assisted researcher Xusheng Li in identifying critical security vulnerabilities, including hardcoded encryption keys and hidden accounts, across four popular USB protection products.
• The vulnerabilities allowed for decryption of protected files without the owner’s password, exposing fundamental flaws in how these products manage cryptographic secrets.
• Affected products include SecZure’s YutianDun, NetacFileLock, KakaSoft USB Copy Protection, and Nexcopy Copy Secure.
• The findings underscore that the primary weaknesses were in secret management and product design, not a compromise of encryption algorithms themselves.

AI-Assisted Analysis Uncovers Critical Flaws in USB Encryption Products

In a significant demonstration of artificial intelligence’s capability to accelerate vulnerability research, OpenAI Codex has played a pivotal role in uncovering severe security flaws within four widely used USB protection solutions. Researcher Xusheng Li utilized the AI tool to expose issues ranging from hardcoded encryption keys to undisclosed administrative accounts, enabling decryption of protected files without the user’s explicit password.

Li’s work highlights a systemic problem in how these products handle sensitive cryptographic information, rather than a breakthrough against the underlying encryption algorithms. In one instance, Codex identified a critical weakness in just seven minutes, showcasing the speed at which AI can pinpoint vulnerabilities within complex codebases.

The Research and Affected Products

The detailed findings were published by Xusheng Li on Binary Ninja’s blog on October 22, 2026. Collaborating with Binary Ninja’s MCP server and OpenAI Codex, Li conducted an in-depth analysis of four specific products: SecZure’s YutianDun, NetacFileLock, KakaSoft USB Copy Protection, and Nexcopy Copy Secure. The methodology combined static software analysis with dynamic testing on protected files, effectively illustrating AI’s potential in rapidly identifying encryption control mechanisms.

Vulnerabilities Uncovered Across Solutions

SecZure YutianDun: This product is designed to shield encrypted files and present them through a proprietary reader that prevents unauthorized copying, screenshots, and printing. Li discovered that YutianDun incorporated two hidden, built-in accounts. These accounts, named “Buffer” (password: 123456) and “System” (password: SECZURE.COM), could unlock the identical content identifier used to derive the file encryption key. Crucially, both accounts functioned on two tested drives without requiring the Administrator password. Li characterized these as “technical backdoors,” clarifying that there was no evidence of malicious intent behind their inclusion. Further, the product’s design relied on MD5 for key generation and restricted its AES keys to a maximum of 64 bits of randomness. However, the presence of these hidden accounts offered a direct bypass to the owner’s password protection.

NetacFileLock: When prompted to evaluate NetacFileLock’s encryption, OpenAI Codex swiftly identified a fixed 32-byte AES-256 key embedded directly within the executable file within seven minutes. This discovery revealed that the user’s password authentication was separate from the encryption key derivation process and did not influence the key itself. Codex further detected passwords within diagnostic logs, identified MD5-based password checks, and observed independent block encryption behavior resembling ECB mode.

KakaSoft USB Copy Protection 5.6.0.299: Even when configured to its highest protection setting, KakaSoft USB Copy Protection was found to be vulnerable. Its Blowfish encryption key was not derived from the user’s password but from an internal password generated from an embedded seed. AI capabilities were instrumental in tracing the custom hashing code and subsequently recovering this secret. After receiving a protected drive, the AI-assisted analysis took approximately 26 minutes to locate the hidden file and demonstrate passwordless decryption.

Nexcopy Copy Secure: For Nexcopy Copy Secure, provisioned via Drive Wizard 1.0.81, a fixed secret was found stored within its viewer application. This secret allowed access to a configuration containing the content key and initialization vector for Triple-DES encryption. While password and device checks governed access to the viewer, they did not safeguard the actual file encryption key. The analysis for this product was completed in roughly ten minutes.

These findings resonate with previous security investigations, such as those uncovering smart bulb flaws exposing Wi-Fi passwords or the UxCryptor ransomware utilizing embedded AES keys. Such cases consistently demonstrate that the mere label of “encryption” does not automatically guarantee security, especially when fundamental principles of secret management are overlooked.

Xusheng Li’s research was published without conventional coordinated disclosure. While the report does not assert that all encrypted USB drives are inherently vulnerable, it provides compelling evidence for why consumers and organizations must demand proof that user-defined passwords directly protect content keys, rather than merely controlling access to a viewing application.

What You Should Do

• Verify Key Derivation: If using USB encryption products, inquire with vendors about how encryption keys are derived. Ensure that user passwords directly contribute to the cryptographic key material, rather than merely unlocking an interface.
• Demand Transparency: Seek products from vendors who are transparent about their security architecture, key management practices, and undergo independent security audits.
• Avoid Products with Hardcoded Secrets: Be wary of any security product that relies on hardcoded keys, default credentials, or hidden accounts, as these represent critical vulnerabilities.
• Implement Layered Security: Rely on a combination of strong passwords, multi-factor authentication, and robust encryption from reputable providers for sensitive data, rather than single-point solutions.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.