#555: VirtualBox VM Escape: Integer Overflow Explained Clearly

In this episode, David Bombal sits down with vulnerability researcher Vladimir Tokarev (with Dawid on the interview) to show what AI-assisted vulnerability research looks like when it actually works.

Vladimir walks through two real vulnerability case studies and uses them to explain a practical workflow for finding bugs faster with LLMs, without pretending the AI is “fully autonomous.”

Demo 1: Gemini CLI command injection

Vladimir demonstrates a command injection issue in Gemini CLI tied to the IDE / VS Code extension install flow. He shows how a malicious VSIX file name or path can be crafted so that when the install command is executed, the system ends up running an attacker-controlled command (the demo uses a harmless calculator launch to prove execution). The conversation then breaks down what a VSIX is, what the realistic attack paths are (user tricked into installing a malicious extension or placing it in the right directory), and why this class of bug matters for endpoints running local AI agents.

Demo 2: VirtualBox integer overflow and VM escape class impact

Next, Vladimir switches to a VirtualBox vulnerability involving an integer overflow that can lead to out-of-bounds read/write in the host process. Because of architecture constraints, he shows the exploit behavior via a recorded clip, then explains the bug using source code. The key teaching moment is the mismatch between 32-bit arithmetic used in bounds checking and 64-bit pointer arithmetic used during the actual memory move, creating a pathway to bypass checks and copy memory outside the intended buffer.

Vladimir also explains why having both read and write primitives is powerful for exploitation, and how modern mitigations make “blind” exploitation unrealistic without memory disclosure.

How the bugs were found with AI

Vladimir then explains the workflow he uses in real engagements:

• Run static analysis to generate leads at scale

• Use an LLM to triage and filter out noise

• Validate the remaining findings by tracing code paths and checking exploitability

• Use AI again to accelerate setup, debugging, reverse engineering, and iteration

He shares a key insight: the win is not “AI finds everything for you,” it is that AI helps you spend your time on the hardest parts—validation, exploit logic, and decision-making—instead of drowning in thousands (or millions) of findings.

Why there is no fully autonomous vuln-research agent yet

Finally, Vladimir lays out four practical blockers:

1. Depth reasoning (long multi-step exploit chains)

2. Context limits (missing system-level constraints and assumptions)

3. Learning from failure (repeating bad leads)

4. Exploration (poor goal-driven search without strong reinforcement learning)

The interview ends with advice for newcomers: start by reproducing known CVEs, learn by doing, and use AI with guardrails to avoid hallucinations and time-wasting rabbit holes. Vladimir also mentions workshops where he teaches these workflows at conferences.

// Vladimir Tokarev’s SOCIAL //

X: https://x.com/G1ND1L4

LinkedIn: / vladimir-eliezer-tokarev

// Dawid van Straaten’s SOCIAL //

LinkedIn: / dawid-van-straaten-31a3742b

X: https://x.com/nullaxiom?s=21

// David's SOCIAL //

Discord: discord.com/invite/usKSyzb

Twitter: www.twitter.com/davidbombal

Instagram: www.instagram.com/davidbombal

LinkedIn: www.linkedin.com/in/davidbombal

Facebook: www.facebook.com/davidbombal.co

TikTok: tiktok.com/@davidbombal

YouTube: / @davidbombal

Spotify: open.spotify.com/show/3f6k6gE...

SoundCloud: / davidbombal

Apple Podcast: podcasts.apple.com/us/podcast...

// MY STUFF //

https://www.amazon.com/shop/davidbombal

// SPONSORS //

Interested in sponsoring my videos? Reach out to my team here: [email protected]

Disclaimer: This video is for educational purposes only.