OpenVDDK opens the VMware disk library Broadcom restricted in August

The project is called OpenVDDK. It does one thing: it loads in place of libvixDiskLib.so.8.0.3. That is the library VMware backup and migration tools use to read virtual disks.

The Register reported on 3 November that its author, cloud architect Andrija Panić, wrote it from scratch in Go. A thin C layer exposes the same C interface, library name and symbol versions as VMware's code. VDDK itself is a set of libraries and utilities, in VMware's own description. They let developers build software to access and manipulate virtual disks. Backup vendors used it. So did migration tools. That mattered when VMware restricted downloads to partners in August. Customers lost access, and some rival migration products got weaker.

What Panić built, and what he says it does

Panić told The Register he tested OpenVDDK against vSphere 6.7 U3, 7.0.3, 8.0.3 and 9.1.1. On the last of those, reading through vCenter on a standalone ESXi host, he says every disk read matched. The tool cannot write disks. It reads them, for backup and migration.

That is a narrower job than VDDK does. It is also the job that broke when the download page closed. He also says the reports of production use are not audited endorsements. "I've received reports of production use, including a German cloud provider migrating a large file server with V2K Migrate and a US-based company migrating to Apache CloudStack/KVM," he told The Register. He added that these are "not independently audited customer endorsements or a guarantee of suitability for every production environment." Independent testers, he said, have reported success with Forklift and MTV on OpenShift, a Proxmox VE pipeline, and custom nbdkit-based tools.

"I didn't think it was fair that people's ability to move or protect their own data should depend on a download page." Andrija Panić, to The Register

The context he gave for the project is a list of tools that all lean on the same small library. They include virt-v2v and nbdkit, the importers in Forklift and MTV, Proxmox VE, Apache CloudStack, plus in-house scripts. Each of them became harder to install after August. OpenVDDK is not the only answer to that. The Register notes that OpenNebula's OneSwap claims a 96 percent success rate. Nutanix adjusted its Move tool to work without VDDK, and Red Hat has published a workaround while it works on a fix.

The bigger argument: who maintains the plumbing

This is a migration story. But it lands in the middle of a wider argument about open source infrastructure and who keeps it running. That argument has been loud this autumn. Anthropic has been giving away vulnerability scans for open source projects. Google paused its open source bug bounty after a flood of invalid AI-generated reports. The foundation behind PHP's vulnerability response was reported to have one full-time employee.

Cisco's contribution came on 28 October, when it open sourced Project Quarry, a behaviour detection engine for AI agents. Amy Chang, who heads AI threat and security research at Cisco, told The Register in an interview that existing tools ask whether an agent attempted prompt injection or called an attack tool. But they miss "the entire context under which something may occur." Quarry watches whole agent sessions, including tool calls and Model Context Protocol interactions. It ships plugins for Claude Code, Codex and other MCP-compatible agents. The comparison Cisco makes is to Snort and YARA: a shared language for describing behaviour.

Vendor security money is moving in the same week. OpenAI said on 3 November that it had quadrupled bug bounty payouts, according to The Decoder. Critical bugs in ChatGPT or Codex are worth up to $30,000, exceptional findings up to $100,000, and bonuses take the total to roughly $172,000. Reporting from the last 30 days gets the difference paid retroactively. The company also plans a security sprint with the firm Cathedral and its own engineers. In the previous sprint, 25 percent of OpenAI's product engineers worked on finding vulnerabilities, the company said.

Infrastructure fights that are not about code

Open source is not the only front. On Monday, OpenAI began using the phrase "compute campus" in an announcement for its Grid Protectors Program, The Verge reported on 3 November. The program starts with a site in Effingham County, Georgia. In roughly 900 words, "data center" appeared twice.

The Verge quotes Holly Elmore of PauseAI US saying the company is responding to the unpopularity of data centers. She said renaming them "may fool listeners once or twice", but the problem is the construction, not the label. Tom's Hardware had reported a day earlier that OpenAI was weighing the rebrand. Power is the other constraint. Tom's Hardware reported on 3 November that xAI is running eight converted jet engine turbines at a Mississippi data center. The permits allow a 25 percent higher limit for volatile organic compounds. The Southern Environmental Law Center has challenged Mississippi's approval, arguing xAI has not shown the turbines meet standards for pollutants including formaldehyde. The same group previously sued xAI over gas generators used without the required permits.

People keep arriving at the same conclusion: the layer everyone depends on needs someone to look after it. Panić's answer was to write the library himself. "Many tools that have nothing in common except VMware use the same small library to read a virtual machine's disks," he told The Register. "When public VDDK downloads ended, all of them became harder to install and run."