Theoretically, they could sabotage the crypto algorithms, hope that someone uses it, intercept that communication, and decrypt it using the sneaky weakness they introduced.

Or the right circumstances could cause the library to make requests to their secret government hacking command-and-control server.

Seeing that they released this at github.com/gchq/..., I'd keep my eyes open for requests to secret-hacked-data-backchannel.open-exploit-project.gchq.co.uk

(Or, with less sarcasm: this is probably the project on github with the lowest possibility of containing government backdoors).

(or maybe that's just what they want you to believe)

(or maybe that's just what /we/ want you to believe)

(or maybe that's just what /I/ want you to believe)

You should probably read the manual before using a webapp for your encryption needs. From the Readme:

>it should be noted that the analyst is not a professional developer and the code has not been peer-reviewed for compliance with a formal specification

>Cryptographic operations in CyberChef should not be relied upon to provide security in any situation. No guarantee is offered for their correctness.

I did read that, and I don't believe it provides any clarity related to what I wrote.