Researcher uses Codex to bypass four USB encryption products
Original title: OpenAI Codex Breaks USB Encryption in Minutes, Exposing Hardcoded Keys and Security Flaws
Hidden accounts and hardcoded keys decrypted protected files without owner passwords, one flaw in seven minutes.
Researcher Xusheng Li, using OpenAI Codex with Binary Ninja’s MCP server, analyzed SecZure YutianDun, NetacFileLock, KakaSoft USB Copy Protection and Nexcopy Copy Secure. He reported hardcoded keys, hidden accounts and password checks that did not protect content keys. He published the findings on Binary Ninja’s blog on October 22, 2026, without conventional coordinated disclosure, and said the results do not show every encrypted USB drive is vulnerable.
Unconfirmed: The report does not prove malicious intent or that all encrypted USB products are affected.
- YutianDun accounts Buffer and System used 123456 and SECZURE.COM.
- NetacFileLock contained a fixed 32-byte AES-256 key independent of the password.
- KakaSoft 5.6.0.299 was decrypted in about 26 minutes at its highest setting.
- Nexcopy, provisioned with Drive Wizard 1.0.81, stored a fixed viewer secret.
- Li called the YutianDun accounts a technical backdoor but not proof of intent.
Impact: Decrypt protected USB files without the owner password
| Product | Affected |
|---|---|
| SecZure YutianDun | — |
| NetacFileLock | — |
| KakaSoft USB Copy Protection | 5.6.0.299 |
| Nexcopy Copy Secure | provisioned with Drive Wizard 1.0.81 |
- 1.Check whether a product’s password protects the content key, not only the viewer.
- Organizations
- Binary Ninja
- AI models
- OpenAI Codex
From the original article
2 min read at cybersecuritynews.com
OpenAI Codex helped researcher Xusheng Li uncover flaws in four USB protection products, including hardcoded encryption keys and hidden accounts that allowed files to be decrypted without the owner’s password. In one test, Codex identified the main weakness in seven minutes. The findings expose failures in how these products handle secrets, rather than a breakthrough […]
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.