Security researcher Xusheng Li reportedly found that the Lenovo ThinkPlus FU100 stored files unencrypted on an internal card, despite being marketed as AES-256 encrypted. Its fingerprint reader controlled the USB connection; it did not encrypt the files. Reports describing Li’s finding were published Nov. 1, 2026.
The FU100 fingerprint reader controlled access, not encryption
A fingerprint check can control whether a drive connects to a computer. Encryption protects the files themselves by making stored data unreadable without the right key. In Li’s reported finding, the FU100 did the former, while its internal card held unencrypted files.
What Codex was used to examine
Li reportedly used OpenAI Codex alongside reverse-engineering tools to examine other vendors’ USB protection software. The reports attributed the FU100 hardware finding to Li’s device inspection, not to Codex.
In Li’s reported tests, Netac software yielded a fixed key and a user password in diagnostic logs in about seven minutes. It took about 26 minutes to reconstruct an internal password in KakaSoft USB Copy Protection and decrypt a test file without the user’s password. In about 10 minutes, Li identified a certificate in the Nexcopy Copy Secure viewer app that unlocked a key. These were timings for specific tests.
Li also reportedly found two hidden accounts with simple passwords in SecZure’s YutianDun. The software development kit covered nine other storage devices from multiple vendors; most reportedly could reveal passwords, and two stored data unencrypted on microSD cards.
The TSD303 had a different security flaw
Li’s reported findings about the Lenovo TSD303 concerned password handling. Its data was encrypted, but an earlier design sent the correct password over USB in plaintext for software to compare. A first reported fix used a timestamp-like value to derive a key that Lenovo software could reconstruct. A later reported fix made the drive check the entered password itself.
Lenovo’s reported corrections
Reports published Nov. 1 said Lenovo had issued fixes covering the FU100, FU200, TU800 and TSD303. The described service route was in China, with replacement or an on-site firmware update as options. Lenovo advised backing up data and wiping a drive before returning it.
