Email [email protected] GitHub zzjas x zzjas98 LinkedIn zijie-zhao Google Scholar Scholar

About me

I am Zijie Zhao, a final-year PhD candidate (expected graduation May 2027) in the PL/FM/SE group at University of Illinois Urbana-Champaign advised by Lingming Zhang.

My research combines LLM agents, program analysis, and automated testing to improve software reliability and security. I build multi-agent systems for code and test generation, execution-based validation, and analysis of complex software, including compilers, operating systems, browsers, and distributed systems. These agentic systems scale to widely used, multi-million-line codebases such as the Linux kernel and Firefox. Overall, my work has discovered 300+ bugs, including 40+ CVEs.

I obtained my bachelor's and master's degree in Computer Science at University of California San Diego.

Publication

AnyPoC: Universal Proof-of-Concept Test Generation for Scalable LLM-Based Bug Detection

Zijie Zhao, Chenyuan Yang, Weidong Wang, Yihan Yang, Ziqi Zhang, Lingming Zhang

arXiv 2026

arXiv Bugs Found GitHub

KNighter: Transforming Static Analysis with LLM-Synthesized Checkers

Chenyuan Yang, Zijie Zhao, Zichen Xie, Haoyu Li, Lingming Zhang

SOSP 2025

ACM DL GitHub

KernelGPT: Enhanced Kernel Fuzzing via Large Language Models

Chenyuan Yang, Zijie Zhao, Lingming Zhang

ASPLOS 2025

ACM DL GitHub

WaVe: a verifiably secure WebAssembly sandboxing runtime

Evan Johnson, Evan Laufer, Zijie Zhao, Dan Gohman, Shravan Narayan, Stefan Savage, Deian Stefan, Fraser Brown

IEEE S&P 2023 🏆 Distinguished Paper Award

IEEE GitHub

Industry Experience

May - Aug 2024, Feb - Aug 2025

Software Engineering Graduate Intern

  • Built MoveSmith, a generation-based, coverage-guided fuzzer for the Aptos Move compiler and VM.
  • Designed a modular program generator that encodes Move language constraints such as ability, borrow, and lifetime rules, and runs incremental static analysis during generation to produce valid test programs.
  • Developed an LLM-based Move program generator to test emerging Move language features.
  • To date, MoveSmith has found 50+ bugs in both the compiler and the VM.

GitHub

June - Sept 2019

Software Engineer Intern

  • Used React.js, MobX.js, and Bootstrap to build complex web-based financial applications.
  • Maintained existing server-rendered applications built by Ruby on Rails.
  • Reduced page loading time from 18s to 2s and data saving time from 100s to 15s.
  • Optimized over 2400 SQL queries into 600 queries.

Teaching Experience

  • UIUC CS 527: Topics in Software Engineering
  • UIUC CS 427: Software Engineering I
  • UCSD CSE 127: Intro to Computer Security
  • UCSD CSE 21: Mathematics for Algorithms and Systems
  • UCSD CSE 12: Basic Data Structures and OOD
  • UCSD CSE 11: Introduction to Java

Selected Bugs

A selection of bugs that my work found:

  • Firefox
    • CVE-2026-12292 ($3,000 bug bounty granted)
    • CVE-2026-12305
    • CVE-2026-12291 ($4,000 bug bounty granted)
    • CVE-2026-2806
    • CVE-2020-26960 ($1,000 bug bounty granted)
  • Linux kernel
    • CVE-2024-23851, CVE-2023-52429, CVE-2024-23848, CVE-2024-23850, CVE-2024-25739, CVE-2024-23849, CVE-2024-25740, CVE-2024-26655, CVE-2024-25741, CVE-2024-43825, CVE-2024-50103
  • OpenSSL
    • CVE-2026-35188