[jakeinspace]

I can't think of many things more fun than coming up with some clever USB descriptor hacks to allow an innocuous drive full of pictures of grandchildren to carefully switch into an HID device when it thinks the coast is clear. I have to imagine there's a lot of little tricks you could implement which would be difficult to trigger in a sandbox and might require dumping the EEPROM (if that's possible).

[j16sdiz]

There are quite a few usb descriptor related exploits.

e.g. https://www.cvedetails.com/cve/CVE-2013-3200/