Is this encryption algorithm built from MD5 secure?
The algorithm (now reasonably clear) is reminiscent of a block cipher in CFB mode, with $random$ as the IV (which can be public), $secret$ as the key, and MD5 used as keystream generator instead of the block cipher.

Decryption works as in CFB:
\begin{align*}
M_1 &amp;= C_1 \oplus \operatorname{MD5}( secret\mathbin\|random )\\
M_n &amp;= C_n \oplus \operatorname{MD5}( secret\mathbin\|C_{n-1} )
\end{align*}

If MD5 was secure in the Random Oracle Model, that would be as secure as a 128-bit block cipher in CFB mode. Although MD5 is not secure in the ROM, I do not see an attack compromising the confidentiality of the message in a non-interactive attack, assuming the $secret$ is unguessable and $random$ not reused. In particular, I do not see that the feasibility of MD5 collisions, or MD5's length-extension property, directly enable an attack.

Main issues are:


This is unsafe if $secret$ is short or/and susceptible to enumeration, for there is no key stretching used.
This is unsafe if the attacker can inject something in the message being encrypted, based on earlier ciphertext blocks in the same message.
This is unsafe if the deciphering side reveals deciphered messages that do not make sense, and the attacker can modify the ciphertext.
There is no attempt at protecting the integrity of the message.
No test vectors are given.
This is inefficient compared to a block cipher (but in a context where MD5 is the only efficiently implemented cryptographic primitive, it might still beat a block cipher coded in an interpreted language).
MD5's name is tarnished, it has known weaknesses, and attacks only get better.
The whole thing is not an established algorithm, and nothing in the present answer constitutes any form of endorsement, much to the contrary.