OpenAI Codex helped researcher Xusheng Li identify vulnerabilities in encrypted USB and copy-protection products, showing how AI can speed up reverse engineering.
Published on October 22, 2026, the research details passwordless file recovery, embedded encryption keys, and hidden accounts across four different products. Using static analysis, Codex reproduced a previously identified flaw in just seven minutes.
The findings highlight poor key management and flawed authentication designs, not mathematical attacks on encryption algorithms. In several cases, passwords controlled access through the official software but didn’t dictate the keys protecting the files.
OpenAI Codex Breaks USB Drive Encryption
Through Binary Ninja’s Model Context Protocol interface, Codex analyzed NetacFileLock after a simple prompt asking whether its cryptosystem was secure.
Within seven minutes, it discovered a fixed 32-byte AES-256 key embedded in the executable. Password verification happened separately, allowing the system to decrypt files without the user’s password.
The analysis also uncovered plaintext passwords in diagnostic logs, MD5-based password verification, an unkeyed MD5 file signature, and another fixed key for SM4 encryption.
Independent 16-byte encryption blocks exhibited ECB-style behavior without an initialization vector or chaining. Additionally, Codex explained a partial encryption feature in which the fast mode encrypted only one-third of eligible files larger than 1,024 bytes.
Li’s examination of SecZure’s YutianDun revealed built-in Buffer and System accounts with fixed passwords. Both accounts contained wrapped copies of the same content identifier used to derive the file encryption key.
On two tested drives, these credentials recovered the identifier and enabled file decryption without needing the Administrator password. Li described this as a technical backdoor without implying malicious intent. Additional weaknesses identified included rapid MD5/HMAC-MD5 derivation and hexadecimal truncation, which limited AES key entropy to a maximum of 64 bits.
KakaSoft USB Copy Protection version 5.6.0.299 offered three protection levels. The Normal setting did not encrypt files, while High only scrambled a limited prefix using a key with 256 possible variations.
The Highest setting employed Blowfish in CBC mode. However, on derived its key from an embedded seed rather than the user’s password. The AI found protected content in an unusual exFAT directory structure, analyzed a modified MD5 implementation, and recovered the internal password needed to derive file keys.
Initial unpacking and cryptographic analysis took about nine minutes, while demonstrating recovery from the supplied drive required an additional 26 minutes and six short prompts.
The following simplified pseudocode illustrates the key-management flaw reported in SecZure’s YutianDun. The hidden accounts hold separately wrapped copies of the same content identifier, allowing their fixed credentials to recover the file-encryption key without the Administrator password.
textAdministrator password → Administrator's wrapped identifier ─┐
Buffer / 123456 → Buffer's wrapped identifier ─────────┼─→ Content identifier
System / SECZURE.COM → System's wrapped identifier ─────────┘
↓
AES file key
↓
Decrypted filesFor Nexcopy Copy Secure, provisioned using Drive Wizard version 1.0.81, the AI traced an embedded application value to an encrypted configuration containing the content key and initialization vector.
Files used three-key Triple-DES in CBC mode. Password and USB device checks controlled viewer behavior but did not cryptographically protect the file key. The investigation took around ten minutes and involved five prompts.
These demonstrations illustrate how swiftly AI-assisted analysis can expose secrets embedded in client software. They do not imply that every encrypted USB product is vulnerable.
Li published his findings without conventional coordinated disclosure because recalling or updating deployed devices is challenging. His primary warning is that password prompts and copying restrictions do not necessarily guarantee cryptographic confidentiality.
Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.
