Patrice Godefroid

Patrice Godefroid is a software-testing researcher known for model checking, whitebox fuzzing and, most recently, AI coding agents at Microsoft. He earned a Ph.D. in computer science at the University of Liège in 1994, worked at Bell Labs from 1994 to 2006, and joined Microsoft Research in 2006, where he co-developed SAGE, the first whitebox fuzzer for security testing. He co-founded the Project Springfield cloud fuzzing service in 2015 and co-created the RESTler REST API fuzzer in 2017. His 1991 paper with Pierre Wolper won the LICS Test-of-Time Award in 2011, and his 2008 whitebox fuzzing paper won the NDSS Test of Time Award in 2022. After co-founding the Code Security team at Lacework in 2022, he returned to Microsoft's CoreAI division in 2025 and worked on super-reliable AI coding agents until July 2026.

Badges: Bridge
Boomerang

Timeline

1989–1994

Degrees from Liège

He earns a B.S. in electrical engineering, with a computer science elective, in 1989 and a Ph.D. in computer science in 1994, both at the University of Liège in Belgium. Part of his doctoral work is a Partial-Order Package for SPIN.
1994–2006

Bell Labs, VeriSoft and DART

From 1994 to 2006, he works at AT&T/Lucent Bell Laboratories, where he becomes a distinguished member of technical staff in 2001. His VeriSoft tool, the first software model checker for mainstream programming languages such as C and C++, dates to around 1996. In 2005, he coauthors the DART paper on automatic test generation with Nils Klarlund and Koushik Sen at PLDI.
2006–2012

SAGE at Microsoft Research

In 2006, he joins Microsoft Research, and for several years his main project is SAGE, the first whitebox fuzzer for security testing. SAGE builds on the 2008 paper "Automated Whitebox Fuzz Testing," written with Michael Y. Levin and David Molnar, and is credited with finding roughly one third of the security vulnerabilities discovered by file fuzzing during the development of Windows 7. He is promoted to Partner Researcher in 2012.
2011

A LICS Test-of-Time Award

His 1991 paper "A partial approach to model checking," written with Pierre Wolper, wins the LICS Test-of-Time Award in 2011. The paper presents a model-checking method for linear-time temporal logic that avoids the state explosion caused by modeling concurrency through interleaving.
2015–2017

Project Springfield and RESTler

In 2015, he co-founds Project Springfield, the first commercial cloud fuzzing service, and serves as its CTO. Microsoft announces the service at Ignite in Atlanta in September 2016 as a combination of artificial intelligence and fuzz testing tools, with SAGE as its fuzzing component, and renames it Microsoft Security Risk Detection in May 2017. Also in 2017, he co-creates RESTler, the first stateful REST API fuzzing tool for finding security and reliability bugs in cloud services.
2022

An NDSS Test of Time Award

The 2008 paper "Automated Whitebox Fuzz Testing," written with Michael Y. Levin and David Molnar, wins the NDSS Test of Time Award in 2022. The award recognizes an early demonstration of how to make symbolic execution practical and useful at scale.
2022–2024

Code security at Lacework

In 2022, he joins Lacework, a cloud security startup, as a Distinguished Engineer and co-founds its Code Security team. The team launches static-analysis products for software composition analysis and for finding security bugs in first-party code. Fortinet acquires Lacework in 2024.
2025–2026

AI coding agents at CoreAI

In 2025, he returns to Microsoft to join its newly formed CoreAI division, where he works on super-reliable AI coding agents until July 2026.