OpenCode Gives Away $100 DeepSeek Credits: Subscription Arbitrage and Security Alerts Run Rampant

A "Punch Above Your Weight" Subscription Design

The most eye-catching item in the AI daily news is that OpenCode offers Go subscribers a monthly DeepSeek^Ad V4.1 Flash quota. According to the Bilibili AI Daily program, the Go subscription itself has a very low monthly fee, while the bundled quota far exceeds the subscription itself—equivalent to leveraging a large usage volume with a small monthly fee.

There is no such thing as free quota. This giveaway comes with two restrictions: only a portion of the monthly quota can be used every 5 hours, with an additional weekly cap, and pricing is split into peak and off-peak—input and output prices per million tokens are significantly lower during off-peak hours and double during peak hours. The program estimates that with this quota, about 210,000 requests can be made per month.

Another notable promise: the model is not used for training and does not retain data. For developers who hand code and internal documents to the model, this matters more than the quota numbers.

Behind the Arbitrage Is Compute Scheduling

This combination of "low-price subscription + large giveaway + time-based throttling" is essentially packaging idle compute and selling it to price-sensitive users. Cheaper off-peak, double during peak—this pricing approach uses price leverage to steer requests toward low-load periods. If developers can move batch tasks to off-peak hours, the actual usable volume will be more cost-effective than the nominal quota.

The so-called "compute scheduling" refers to cloud providers dynamically allocating computing resources based on load. GPU/TPU clusters often have much lower utilization during off-peak periods than during peak; idle compute that isn't sold is simply sunk. Peak/off-peak pricing is a mature practice in infrastructure industries like power and telecommunications: using price signals to shave peaks and fill valleys, steering deferrable loads to low-load periods, thereby improving overall utilization without adding hardware. For subscription-based AI products, this is also a means of creating a gap between "nominal quota" and "actual usable volume"—the more users are willing to schedule batch tasks to idle times, the lower the marginal cost the platform bears.

Extension Marketplace Poisoned: Uninstalling Is Not Enough

The same daily report disclosed a VS Code extension marketplace security incident (also mentioned in the report with Cursor-related wording): a tampered version of the Claude Code extension appeared in the marketplace. The malicious version was not published by the original developer and affected up to about 5,000 users.

The malicious version collects hostnames, usernames, system architecture, and public IPs, and also inserts the attacker's email into authorization files, attempting to establish a reverse tunnel for a long-term backdoor. The platform took down the entire extension marketplace that afternoon and worked with cloud providers to shut down the attack servers.

The program specifically reminds: uninstalling the extension is not enough—you also need to manually clean up persistence scripts. This is a typical feature of supply chain attacks—after the entry point is blocked, the persistence mechanism planted in the system may still survive. For enterprise developers, extension source review, version pinning, and endpoint detection are all indispensable.

A supply chain attack refers to attackers not directly attacking the target but compromising an upstream link trusted by the target—in this case, the publisher account or the extension package itself in the marketplace. Developers trust the source by default when installing extensions, so once the upstream is poisoned, malicious code enters a large number of endpoints in the form of a "legitimate update." Persistence is the final step of the attack chain: attackers write scheduled tasks, startup items, authorization files (such as SSH's authorized_keys), and other mechanisms so that even if the entry program is uninstalled, the backdoor can revive after a reboot. Corresponding defenses include source and signature verification, pinning extension versions to avoid automatic upgrades to poisoned versions, and using EDR-type endpoint detection to discover abnormal outbound connections and reverse tunnels.

Model Autonomously Attacks Browsers: The Danger of the Patch Window

Epoch AI conducted a set of experiments letting an open-weight model attack browsers on its own. The result: it targeted the patch window—Mozilla had already merged Firefox security patches into the code but had not yet pushed them to users, and the model autonomously built web attacks based on this. Users only needed to visit the page to have local files read.

According to the program, multiple Firefox versions released during the experiment were all compromised, with the cost of compromising a single version at about $1,000. But applying the same method to a different target failed despite a much higher cost. This shows that the model's autonomous vulnerability exploitation capability has boundaries, and also that the period when "the patch is merged but not yet pushed" is a real attack surface.

Attack-Defense Tempo Compressed

In the past, the window between patch merge and user update relied on manual analysis and exploitation, with limited speed. With model involvement, the cost of exploiting the window has been compressed to the thousand-dollar level. For browser vendors and security teams, this means the patch release process itself needs redesign—can push intervals be shortened, can forced updates be applied to high-risk patches?

The "patch window," also called the patch gap, refers to the period when vulnerability fix code has been merged into the main branch but has not yet been pushed to users with an official release. At this point the patch itself is public, and attackers can reverse-engineer the vulnerability location and trigger method by comparing code differences—so-called "patch diffing." Traditionally, exploitation during this window relies on manual analysis by security researchers, with speed limited by human effort; but models with code reading and tool-calling capabilities can string together "read diff—construct PoC—generate attack page" into an automated process, compressing the exploitation cost per vulnerability to the thousand-dollar level—equivalent to shortening the defender's reaction time. This is also the direct motivation for vendors to push silent forced updates and shorten release cycles.

SenseTime Open-Sources a Small-Parameter Multimodal Model

SenseTime announced the open-sourcing of a multimodal model called Sensnola Lube (program name), with only 9 billion parameters, trained on sequences up to 260,000 tokens, capable of receiving text and images and generating text.

The key is the architecture: it uses a recurrent-reuse-like approach where some decoder parameters are reused repeatedly, stacking up effective computational depth. SenseTime claims it surpasses larger-parameter models on multiple benchmarks, with 9 billion parameters reaching the level of 27 billion parameters, and already approaching its own client product.

The value of small-parameter models lies in on-device deployment and cost. If 9 billion parameters can truly approach the level of tens-of-billions-parameter large models, the threshold for local deployment and inference cost will drop significantly. However, there is often a gap between benchmark scores and actual experience, and whether architectural innovation can deliver on real tasks still needs third-party reproduction.

"Parameter recurrent reuse" belongs to a class of architectural ideas that trade parameter scale for computational depth: traditional Transformers have independent parameters per layer, and increasing layers means parameters and memory grow in tandem; while recurrent/reuse structures let the same set of decoder parameters be called multiple times, equivalent to deepening the network's effective depth without proportionally increasing parameters. This is in line with research such as Universal Transformer and recurrent depth, at the cost of more serial steps during inference and gradients needing to be backpropagated across multiple reuses during training. The significance of such designs is: smaller model size, lower memory footprint, more suitable for on-device or low-cost deployment, but "punch above weight" benchmark conclusions usually depend on specific benchmarks and require third-party reproduction and verification.

Subscription Naming Adjustment and Quota Changes

Another vendor adjusted its personal subscription naming: the original high-end tier was renamed, with the price unchanged. The real change is that verified high-end accounts gradually have their 5-hour usage limit removed, retaining only the weekly total constraint, with the weekly quota still 10 times the previous one. Verification is done automatically by the system based on account and payment history; users do not need to apply. Unverified accounts still have temporary limits.

This reflects a trend: subscription tiering is shifting from "time-based throttling" to "identity-based tiering." Verified users get a smoother experience, while unverified users bear more constraints, and the platform uses this to control abuse risk.

TPU in Space and Distributed Computing

Google announced that the TPU on its prototype satellite successfully returned the first AI reply. The satellite carries 4 self-developed TPUs with up to 1,000 watts of power. Ground engineers uplinked a prompt asking the pre-installed model to write a poem about being in space; the satellite transmitted the result back as it passed over Svalbard, Norway.

Due to power and heat dissipation constraints, the TPU can only operate continuously for about 20 minutes at a time. Google plans to launch two more satellites later to test cross-satellite distributed computing. Putting compute into orbit is, in the short term, an experiment; in the long term, it is exploring ways to deploy compute free from the constraints of ground power grids and land.

Enterprise Private Intelligence and On-Device Deployment

OpenAI launched a private intelligence solution for business customers, specifically handling sensitive data. It is not a single product but a four-layer package: strict restrictions on the vendor's own access to business content; zero data retention available for workflows that do not meet conditions; customers own the inputs and outputs; enterprises can specify what the agent can access, which actions it can perform, and when human approval is required, plus encrypted access control and threat detection. One of these is in preview, using confidential computing for hardware isolation.

Apple announced that the first batch of Apple Intelligence features will launch in China, with existing Siri, writing tools, and visual intelligence integrating Alibaba's Tongyi Qianwen. According to the program, testing opens with the iOS developer beta starting November 4, and launches with the official release in December. The first batch of features includes real-time translation, photo erase, and writing tools, supporting iPhone 16 and later models, iPhone 15 Pro series, and iPhone Air. Alibaba simultaneously announced that users can choose whether to activate it. This update does not include the next-generation Siri AI.

Capex Soars, Sentiment Inflection Point Appears

This round of AI investment may have seen its first sentiment inflection point. Several hyperscalers' planned capital expenditure for this year totals over $740 billion, but investor attitudes have shifted from rewarding large investments to worrying about free cash flow, rising debt, and uncertain returns, and related stocks have fallen accordingly.

Amazon's CEO is still doubling down, saying AWS can become a trillion-dollar revenue business within 5 to 10 years, and giving a massive figure for cash capital expenditure in the coming years. On one side is the vendor's long-term narrative, on the other is the market's short-term patience; this divergence will determine the pace of AI infrastructure investment in the next phase.

For developers and entrepreneurs, this means compute supply will remain sufficient in the short term, but the financing environment and valuation logic may tighten. Building products on real demand rather than subsidies is more important than ever.

One-line Summary

OpenCode's low-price subscription offers large model quotas, while extension poisoning, autonomous model attacks, and a sentiment inflection point in compute investment also emerge.

Paragraph Summary

This AI Daily revolves around multiple threads of "punching above weight": OpenCode gives Go subscribers DeepSeek V4.1 Flash quota far exceeding the monthly fee, but uses dual 5-hour and weekly throttling plus peak/off-peak price differentials to steer requests to idle times—essentially packaging idle compute for sale. On security, a tampered Claude Code version appeared in the VS Code extension marketplace, affecting about 5,000 users; uninstalling alone is not enough, persistence scripts must also be cleaned. Epoch AI experiments show models can autonomously build web attacks exploiting the Firefox patch window, with a per-version compromise cost of about $1,000. On the model side, SenseTime open-sourced a 9-billion-parameter multimodal model that approaches larger-parameter performance through decoder parameter recurrent reuse. Also covered: subscription naming and quota adjustments, Google's satellite TPU returning the first AI reply, OpenAI's enterprise private intelligence solution, Apple Intelligence integrating Tongyi Qianwen, and a market sentiment inflection point triggered by hyperscalers' combined capital expenditure exceeding $740 billion.