OpenAI Codex recovers keys from four encrypted USB products
Original title: OpenAI Codex Breaks USB Drive Encryption in Minutes, Exposing Critical Security Flaws
Hardcoded AES, SM4, and Triple-DES keys and hidden accounts let files be decrypted without the user password.
Researcher Xusheng Li used OpenAI Codex through Binary Ninja’s Model Context Protocol to analyze encrypted USB and copy-protection software. On NetacFileLock, Codex found a fixed 32-byte AES-256 key in seven minutes, with password checks separate from file encryption. SecZure YutianDun, KakaSoft USB Copy Protection 5.6.0.299, and Nexcopy Copy Secure showed similar key-management failures. Li published without coordinated disclosure, citing the difficulty of updating deployed drives.
Unconfirmed: Li calls the YutianDun hidden accounts a technical backdoor and does not allege malicious intent.
- Codex reproduced a known NetacFileLock flaw in seven minutes from one prompt.
- YutianDun Buffer and System accounts used fixed passwords wrapping the content identifier.
- KakaSoft High mode used 256 key variations; Highest used Blowfish-CBC from an embedded seed.
- Nexcopy used three-key Triple-DES; viewer checks did not protect the content key.
Impact: File decryption without the user’s password
| Product | Affected |
|---|---|
| NetacFileLock | — |
| SecZure YutianDun | — |
| KakaSoft USB Copy Protection | 5.6.0.299 |
| Nexcopy Copy Secure | provisioned with Drive Wizard 1.0.81 |
- AI models
- OpenAI Codex
From the original article
3 min read at gbhackers.com
OpenAI Codex helped researcher Xusheng Li identify vulnerabilities in encrypted USB and copy-protection products, showing how AI can speed up reverse engineering. Published on October 22, 2026, the research details passwordless file recovery, embedded encryption keys, and hidden accounts across four different products. Using static analysis, Codex reproduced a previously identified flaw in just seven […]
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.