OpenAI Codex Breaks USB Encryption in Minutes, Exposing Hardcoded Keys and Security Flaws

OpenAI Codex helped researcher Xusheng Li uncover flaws in four USB protection products, including hardcoded encryption keys and hidden accounts that allowed files to be decrypted without the owner’s password.

In one test, Codex identified the main weakness in seven minutes. The findings expose failures in how these products handle secrets, rather than a breakthrough against encryption algorithms.

Xusheng Li published the research on Binary Ninja’s blog on October 22, 2026. Using AI with Binary Ninja’s MCP server, he examined SecZure’s YutianDun, NetacFileLock, KakaSoft USB Copy Protection, and Nexcopy Copy Secure.

The work combined software analysis with tests on protected files, showing how quickly AI can help researchers find code that controls encryption.

SecZure’s YutianDun hides encrypted files and opens them through readers designed to block copying, screenshots, and printing. Li found that two built-in accounts could unlock the same content identifier used to derive the file encryption key.

The Buffer account used 123456, while System used SECZURE.COM. Both worked on two tested drives without the Administrator password.

OpenAI Codex Breaks USB Encryption

Li described this as a technical backdoor, while stressing that it did not prove malicious intent. The design also relied on MD5-based key generation and limited its AES keys to at most 64 bits of randomness. However, the hidden accounts provided the direct route around the owner’s password.

For NetacFileLock, Li gave Codex one prompt asking it to assess the encryption. Within seven minutes, it found a fixed 32-byte AES-256 key inside the executable.

The password was checked separately and did not determine the encryption key. Codex also found passwords in diagnostic logs, MD5 password checks, and independent block encryption with ECB-style behavior.

Hardcoded secrets have appeared in other security investigations, including Cyber Security News coverage of smart bulb flaws that exposed Wi-Fi passwords and UxCryptor ransomware that used embedded AES keys.

These cases show why an encryption label alone cannot establish security.KakaSoft USB Copy Protection 5.6.0.299 failed even at its highest protection setting. Its Blowfish key depended on an internal password generated from an embedded seed, not the user’s password.

AI traced the custom hashing code and recovered the secret. After receiving the protected drive, it needed about 26 minutes to locate the hidden file and prove passwordless decryption.

Nexcopy Copy Secure, provisioned using Drive Wizard 1.0.81, stored a fixed secret in its viewer. That secret opened a configuration containing the content key and initialization vector for Triple-DES encryption. Password and device checks controlled the viewer but did not protect the file key. Analysis took about ten minutes.

Li published without conventional coordinated disclosure. His report does not establish that every encrypted USB drive is vulnerable. It shows why buyers need evidence that passwords protect content keys, not merely access to a viewing app.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post OpenAI Codex Breaks USB Encryption in Minutes, Exposing Hardcoded Keys and Security Flaws appeared first on Cyber Security News.