Yichao Xu

Baltimore, MD|443-839-0004|yxu166@jhu.edu

github.com/samhsu-dev|linkedin.com/in/yichaoxu-jhu

Summary

Computer Science PhD candidate at Johns Hopkins University developing program analysis and fuzzing methods for software vulnerability discovery. Research also examines AI agents for security analysis and security risks in agentic systems.

Education

Johns Hopkins University — PhD, Computer Science (expected Dec 2027)

Jan 2023–Present

Johns Hopkins University — MS, Security Informatics

Sep 2021–Dec 2022

University College London — MSc, Software Systems Engineering, Distinction

Sep 2019–Oct 2020

Selected Publications

ICSE 2026 (first author). CoBrA: Context-, Branch-sensitive Static Analysis for Detecting Taint-style Vulnerabilities in PHP Web Applications.

IEEE S&P 2023 (second author). Scaling JavaScript Abstract Interpretation to Detect and Exploit Node.js Taint-style Vulnerability.

Skills

Program analysis: Static analysis, taint analysis, abstract interpretation, code property graphs, fuzzing.

Languages: Python, Kotlin, C++, JavaScript, PHP, Scala, Rust.

Tools: Joern, Semgrep, LibFuzzer, Docker, AWS Bedrock.

Selected Research

PHP vulnerability static analyzer (CoBrA)

May 2023–Mar 2025

First author, ICSE 2026 · Johns Hopkins University SecLab

  • Built a PHP static analyzer that found 54 previously unknown vulnerabilities in 19 applications; 9 CVE IDs were assigned.

JavaScript vulnerability analysis at NPM scale (FAST)

May 2021–Nov 2022

Second author, IEEE S&P 2023 · Johns Hopkins University SecLab

  • Implemented JavaScript abstract interpretation and led evaluation of a Node.js analyzer that found 242 previously unknown vulnerabilities in npm packages.

Experience

Core Engineer · Jay-I-break team (JHU)

Feb 2026–Present

2026 Amazon Nova AI Challenge · Competition project

  • Maintained 8 agentic pipelines for software vulnerability discovery. Developed 1 black-box analysis pipeline and 2 dynamic analysis pipelines.

Research Assistant · Johns Hopkins University SecLab

Sep 2021–Present

Research Assistant Intern · China Academy of Industrial Internet

Dec 2020–Mar 2021

  • Designed a Hyperledger Fabric framework for product traceability, with access controls for business-sensitive records.

Open-source Software

Joern (Scala). Contributed PHP version-check fixes, five security-query classes and regression tests. PR #5327 merged.

Harvest Claude (Rust). Built a terminal dashboard that visualizes Claude Code sessions as animated farm characters.