EDIT: please move to crypto (just realized it is the wrong one and “You can only post once every 40 minutes.”)

Suppose I give a sufficiently long key in a secure way (in person) to Alice.

I send her a file that is XORed with the key I initally gave her. In the file, there contains the message and a new, sufficiently long key.

Alice then creates a file and XOR with the key that is contained in my message. (Alice’s file contains her message and a new key)

What weaknesses are there to this approach? (Suppose too that we pad all messages with random bytes such that the file is 100 KiB in size)