Microsoft BitLocker bypassed via USB YellowKey exploit

Microsoft's BitLocker full-disk encryption can be defeated with nothing more than a prepared USB stick, according to researchers who disclosed the YellowKey zero-day this week. The technique requires no credentials, no remote access, and no software exploit in the conventional sense — just files on removable media, suggesting the attack surface is either a deeply buried implementation flaw or, as some researchers are framing it, an intentional access mechanism built into Windows. BitLocker is the default encryption layer protecting hundreds of millions of Windows enterprise machines, including workstations running AI training pipelines, model inference endpoints, and proprietary dataset stores. No patch exists at time of disclosure, meaning every unmitigated Windows machine with BitLocker enabled is currently exposed to anyone with physical access and a prepared drive. Essentially: (Microsoft, enterprise security teams) are now on opposite sides of an unpatched gap with no remediation timeline. - YellowKey requires only physical access and a crafted USB device, raising the threat level for shared lab environments, co-location facilities, and unattended workstations. - The "apparent backdoor" framing from researchers matters: if intentional, no patch will fully close it without Microsoft's cooperation. - AI infrastructure teams running Windows-based GPU clusters should treat physical access controls as the primary mitigation until a fix is confirmed. The episode is a direct challenge to the assumption that full-disk encryption is a reliable last line of defense for sensitive compute infrastructure.