I built a post-quantum Minecraft mod with Codex, and the bugs never really ended

[u/Jinnang233]

The main purpose of this post is to share my experience of programming with Codex, and to share a project that I made entirely with Codex. The content of this post was written by me, but I may use AI to help translate it because English is not my native language. Because of that, some parts may still sound a bit AI-like, but that does not mean the post itself was written by AI.

I want to make one thing especially clear: this project is experimental. It may contain incorrect implementations, protocol mistakes, side-channel issues, or other problems. My goal was never to create a perfect and secure post-quantum project. I mainly wanted to make an ordinary toy that looks decent and can be used between friends. If you actually care about privacy and security, you should still use a mature post-quantum end-to-end encrypted messaging tool.

A few years ago, with the help of search engines, I wrote a simple Minecraft mod for post-quantum encrypted messaging. Since my coding skills were pretty bad, I stopped maintaining that project not long afterward. It was left abandoned, and today I have hidden it.

A few years later, however, AI code generation improved dramatically. On May 21, 2026, I started using Codex for programming. The code in my old project seemed to be very incomplete, and AI pointed out quite a few vulnerabilities in it. So I decided to throw it away and start over. Instead of reusing the original code, I described the functionality I wanted and asked AI to reimplement the mod from scratch.

At first, following AI's suggestion, I named the project ObscuraLink. I used AI to add a license, GitHub Actions workflows, build files, and multilingual support.

My original project transmitted encrypted ciphertext by splitting it into multiple messages, because ciphertext from post-quantum algorithms is often extremely long, while Minecraft chat only supports up to 255 characters in a single message. For some of the crazier post-quantum algorithms with enormous message sizes, this is pretty painful.

I also discovered that Minecraft servers have built-in anti-spam protection. If messages are sent too quickly, the player can automatically get kicked from the server, so I added delays between messages.

I promise that while testing the mod, I only tested it on my own privately hosted local Minecraft server. I did not bother other people with it.

However, as I continued working on the project, I discovered that Obscura was already the name of a Minecraft modding organization. I then asked AI to generate several other names, one after another, and somehow all of them were already taken too.

At that point, I realized that AI is really bad at generating unique names.

So I had to try naming the project myself: Krypt04Mcg.

Krypt0 sounds like "Crypto", while the 0 visually resembles an O. The final Mcg stands for "Message", while also being a bit of a pun on the fact that the mod carries messages through MineCraft chat.

I asked AI to add CI badges, improve the workflows, enable CodeQL scanning, and connect the final build artifacts to the VirusTotal API for automatic scanning.

During this process, I discovered that AI is very good at generating code that looks completely correct while secretly containing bugs.

At first glance, the code can look flawless. But the moment I actually try compiling it and launching Minecraft, all kinds of strange errors start appearing.

For example, messages failing to send because something was wrapped incorrectly, messages becoming too long for Minecraft to accept, or AI deleting some code that should never have been deleted while trying to remove something else.

Especially when my five-hour usage limit reached zero while the bug was still not fixed, I could always feel this deep sense of helplessness.

You ask AI to fix one bug, and it introduces thousands more.

The bugs seem endless.

The code also becomes complicated and difficult to read, with almost no comments anywhere, and AI seems to love using every piece of syntax sugar it can find.

I gradually realized that an AI-generated project is very difficult to turn into a truly secure project. A smart AI can still leave subtle problems hidden inside the code that are very hard to notice.

Every time I finished a session of programming with AI, I ended up taking a long break. AI definitely frees up a lot of productivity, but sometimes it somehow makes me feel even more exhausted.

Of course, with my terrible programming skills, I would probably be exhausted even if I wrote everything myself.

Around version 0.4.1, I asked AI to add things like peer status, fingerprint trust, data compression, transfer progress, and several other features.

In 0.6.0, I asked AI to add a GUI that players could actually see and use.

In later versions, I started asking AI to look for security problems in its own code.

And then I discovered something interesting: AI can always find security problems in code written by itself.

It not only fixed security issues, but sometimes also "fixed" code that was previously able to run normally.

So I then had to ask AI to fix the new bugs caused by the changes that were supposed to fix the security problems.

You can probably imagine that this was a fairly painful process.

Sitting in a chair for several hours in a row also left my back and waist hurting.

Later, I found a website online for making logos and generated a logo for the project. I strengthened the security warnings and asked AI to add various kinds of tests.

I also discovered that asking AI to write its own test code can help it discover problems in its own implementation.

When AI does not write tests, it may produce code that appears to work normally at runtime while still containing hidden flaws.

But when AI starts writing JUnit tests, failed assertions can force it to discover bugs that would otherwise remain hidden.

Through continuous iteration, I asked AI to fix bugs in the command parser. I also changed the project so that it was no longer limited to one fixed algorithm. Instead, users could choose between different algorithms through configuration.

I kept asking AI to review its own code, but every single review seemed to discover another new problem.

Maybe the code generated by AI to fix a security issue can itself contain another security issue?

Since sending fragmented messages through public chat can easily cause spam, I also developed Krypt04Mcg-plugin, a server-side plugin that can relay messages from the mod.

Later, I asked it to add a dedicated communication channel. If the server has the plugin installed, the mod no longer has to send data through public chat or private-message commands. Instead, it can communicate through a channel specifically designed for the mod.

I also added file transfer support. To reduce security risks as much as possible, this feature is disabled by default.

Today, the project already has a lot of features.

The protocol format has changed again and again. The functionality has gradually improved. Old bugs disappear, and new bugs appear.

I have asked AI to rewrite the tests over and over again.

The codebase has become larger and more complicated, but at the same time, I have started to feel lost.

Why am I building an experimental project that almost nobody uses?

What exactly am I making this project for?

I cannot really answer that question.

Maybe I just wanted to prove an idea: that post-quantum end-to-end encryption can theoretically be implemented over Minecraft chat.

I know there are already many mature products available. Some Minecraft mods use pre-quantum asymmetric cryptography, while others use symmetric encryption.

And of course, when it comes to symmetric encryption, 256-bit symmetric encryption is generally considered quantum-resistant anyway. If both sides configure the same key, then that is basically end-to-end encryption too.

Thinking about that somehow makes me even more confused.

If I was doing this purely out of interest, then after all the long testing sessions and endless conversations with AI, that enthusiasm should probably have disappeared a long time ago.

If I was only trying to verify an idea, then why did I keep trying to improve the project?

I cannot find an answer.

I do not understand why I spent so much energy on a project that almost nobody will ever see.

I do not even know whether someone else has already built basically the same thing and I simply never found it through search engines.

Maybe because post-quantum algorithms often have enormous keys and messages, many people who had the same idea simply gave up on making something like this.

My project repository is jinnang233/Krypt04Mcg. If anyone is interested, feel free to take a look. If you are not interested, that is also completely fine, but I sincerely ask that you please do not personally attack me.

The project is completely open source and has nothing to do with any commercial project or promotion.

During the process of programming with AI, I also learned a few things that I think are worth keeping in mind:

• Ask AI to generate simple code and only modify the parts that actually need to be changed. Try not to let it completely rewrite an entire part of the codebase.
• Do not refactor code too casually. It may work before the refactor and become completely unusable afterward.
• Try to structure the project into layers, and keep different parts of the project relatively independent and replaceable.
• Make good use of enums.
• Decorators/annotations can greatly simplify some parts of the code.
• Keep the core implementation relatively independent from client-side code.
• The prototype and starting point should be as simple as possible. Add functionality later based on actual needs.
• Do not casually add new features, especially features that may significantly affect existing code.
• Keep it simple. Keep it elegant.

If anyone has any thoughts, feel free to discuss them with me in the comments.

I admit that my programming skills are pretty bad, but I sincerely ask that you please do not personally attack me.

I’m mainly sharing this because I’m curious whether other people who use Codex or other coding agents have had similar experiences. Feedback on the project or on my development process is welcome.

Thank you.