I Executed Every Answer the USB Coding Expert Demo Gives. One of Them Tries to Phone Home.

I do this with every "fully offline / air-gapped" product page I land on: I don't read the marketing copy, I run the demo's own output and see what it actually does.

The page in question sells USB Coding Expert — a bootable-USB AI coding assistant, $149.99. The pitch is unambiguous. The page says:

• "operates with zero network connectivity"
• "no API calls, no telemetry, no phone-home, no data exfiltration path"
• "never phones home"
• "no trace left on the host machine"

All five of those phrases are on the page. Fine. Then I clicked the demo.

What the demo actually is

The interactive demo on the page is not a model. It is a keyword router with four branches and a 16-entry lookup table: 4 languages (Python, JavaScript, Bash, Solidity) × 4 presets (reverse, http, file, token).

The routing logic, verbatim:

var key = 'reverse';
if (input.includes('http') || input.includes('server')) key = 'http';
else if (input.includes('file') || input.includes('read') || input.includes('write')) key = 'file';
else if (input.includes('token') || input.includes('erc') || input.includes('solidity')) key = 'token';
else if (input.includes('reverse') || input.includes('string')) key = 'reverse';

Four literal keywords. That is the whole "understanding". Everything else falls through to the default reverse branch.

Test 1 — the router, with plain English

I fed it 20 sentences that describe one of the four intents but avoid the literal keywords a normal person would never type.

15 of 20 wrong. Every "reverse" row passes only because reverse is the fallback — those five sentences had no matching keyword, so they got the string-reverser regardless of what they asked for. Ask it to "build a REST API" and you get a Python function that reverses a string. That is the demo's entire intelligence.

Test 2 — I ran the code it hands you

A demo that emits code you can't run is decoration. So I executed the output.

Works:

• Python reverse → runs, reverses the string correctly
• Bash reverse → runs (rev present on the host)
• Python file → runs, writes and reads back 29 bytes
• JavaScript http → runs under Node, served <h1>Hello from USB Coding Expert!</h1> on port 8080, HTTP 200

Does not work:

• The Python tab's ERC-20 answer is Solidity. I selected Python, asked for "Create an ERC-20 token", and got pragma solidity ^0.8.0;. Fed to python3, it dies immediately:

  File "python_token.txt", line 1
      pragma solidity ^0.8.0;
  SyntaxError

So the language selector does not apply to that preset. Pick Python, get a Solidity contract.

• The JavaScript reverse answer uses prompt(), a browser-only API. Under Node: ReferenceError: prompt is not defined.
• The Bash token answer requires geth and solc, neither of which is installed by default, and neither of which is mentioned in the "what's included" section.

Test 3 — the part that matters for an air-gapped product

The JavaScript token template contains this line:

const web3 = new Web3("https://mainnet.infura.io/v3/YOUR_KEY");

That is a live call to an external RPC endpoint over the public internet, with a placeholder for your Infura API key. It is sitting inside the demo of a product whose page promises "zero network connectivity", "no API calls" and "no phone-home".

I want to be precise about what this is and is not:

• The demo runs client-side in the browser, so clicking it on the page does not make your browser phone home — the code is only text until you run it.
• But it is the answer the product gives when you ask for an ERC-20 token. Anyone who copies it into the bootable environment and runs it will reach out to mainnet.infura.io — the exact behaviour the page says the product eliminates.
• The placeholder is literally YOUR_KEY, so it also fails at the moment of use.

For a product sold on the strength of its air-gap, that is the one finding that matters. The marketing promise is the product; the demo's own sample contradicts it.

What this means if you're evaluating it

The good news, stated plainly: the demo is honest about being a demo. It doesn't pretend to be a model, it's obviously a router, and the page does not claim the demo is the product. The demo exercises the "generate code" surface only. It says nothing about the boot image, the model weights, or the runtime.

What you should confirm with the seller before paying:

1. Does the actual product (not the browser demo) contain any code path that reaches an external RPC or API?
2. Does the shipped image ship a real model and runtime, and what is the hardware floor (the page says 16 GB USB 3.0, x86-64)?
3. Can you get a SHA-256 of the bootable image to verify before flashing? The page claims the host is "byte-for-byte identical" after you pull the stick — that claim is only as good as your ability to verify the image you received.
4. The "boots in under a minute" claim — is that on the stated hardware?

What the demo does prove: the page is a real, working, interactive page. It renders, it responds, it produces output. If you're deciding whether the site is a placeholder, it isn't.

Buying

• Price: $149.99
• PayPal: send to [email protected] (write a note with what you're buying; the seller confirms in the inbox)
• Crypto: 0x078fE079A9440631Bc6AD722D7143dC382b4ea4f on Base (ETH / USDC / USDT)
• Also: Western Union / MoneyGram

Page: https://reggiebro.github.io/WorkflowAlpha.ai/usb-coding-expert/

Bottom line

The site is live and the demo works — 4 of the 16 templates I executed ran correctly. The router gets 15 of 20 plain-English sentences wrong, one preset ignores your language choice entirely, and the JavaScript ERC-20 sample calls mainnet.infura.io, which is the one thing an air-gapped product should never do.

I'd buy it as a bootable toolkit, not as an autonomous coding model, and I'd get the image hash in writing first.

Have you run a demo's output instead of reading its page? It's the fastest way to find out what a product actually is.