Tuesday's brief is about the bill. One story shows what a leaked key costs you overnight. The other three are price cuts across the agent stack: search, a mid-size model, and the extraction step most of us still hand to an expensive LLM.
No sponsored or affiliate links in this digest — the links below are sources only.
Story I
Attackers broke into OpenCode Console and ran up charges on users' OpenAI, Anthropic and Google keys
OpenCode, the open-source coding agent people use as an alternative to Claude Code and Cursor, said on Saturday that attackers had broken into an older system overnight. The breach hit 1.4% of OpenCode Console users, the web platform where some people keep provider API keys in workspaces. Developers woke up to spending alerts. TechCrunch reports individual accounts were charged hundreds of dollars, and a few reported totals above $1,000. The open-source app and the CLI weren't affected, and co-founder Dax Raad said the keys never reached OpenCode's other products.
OpenCode called it "a large-scale distillation attack" on X and hasn't explained how attackers got in or how keys were stored. Skeptics think the break-in was simpler than that label suggests. Anthropic and Google blocked keys they believed were exposed, OpenAI is refunding credits used in the attack, and OpenCode says refunds are underway and the incident is still ongoing. One odd detail: the models OpenCode used to analyze the attack code started refusing once the malicious code tripped their safety filters. Things improved only after the team got into OpenAI's Daybreak Blue program for vetted defensive security work.
For builders
If you got OpenCode's email, revoke those keys at each provider now; rotating them inside the Console isn't enough. Everyone else: open the billing settings at every model provider you use and set a hard monthly limit plus an alert at 50% of normal spend. Then give each tool its own key, so a leak in one place kills one key and you can see exactly which tool burned the money. Where a tool can read keys from an environment variable, keep them out of its hosted dashboard.
Story II
DeepSeek prices web search at $0.75 per 1,000 requests, and Exa answers with a $4 Lite tier
DeepSeek opened the search engine behind its chatbot as two APIs on Saturday. Search returns ranked results with titles, URLs, snippets and summaries; Fetch returns a page as Markdown. Each costs $0.75 per 1,000 successful requests, and failed calls, empty results and timeouts are free. A single search can return up to 50 results for the same price, and both endpoints are capped at five requests per second per account. The New Stack lists list prices around it: Ceramic at $0.25, Parallel and Perplexity at $1, Exa Instant at $4, Brave at $5 and Tavily at $8 per 1,000 basic searches. The catch is in DeepSeek's privacy policy, which says personal data is stored in China and inputs are generally kept while an account stays open.
Exa shipped 3.0 on Monday. The new Lite tier costs $4 per 1,000 requests and you set it with type: "lite" on /search; Auto is $7. Exa says it leads Perplexity, Brave and Parallel on eight benchmarks, such as BrowseComp at 91.8% against Perplexity's 91.5%. Exa ran all of them itself, ATLAS is its own benchmark, and several leads are under two points. That's a near tie, priced differently.
For builders
Yesterday's TinyFish story showed that page size drives agent cost; today the per-request price is moving too. Put search behind one small interface in your code (query in, list of URL, title and text out) so changing providers is a config change. Then run 50 queries from your own logs through two or three providers and score them on answer accuracy and characters returned. If your users type anything personal into search, read DeepSeek's data terms before you send their queries to it.
Story III
MiniMax M3.1 Flash costs $0.15 per million input tokens and speaks the Anthropic API
MiniMax released M3.1 Flash on Monday: a 428B mixture-of-experts model with about 23B active parameters, a 1M-token context and text plus image input. Pricing is $0.15 per million input tokens, $0.60 per million output and $0.015 for cache reads. It's served through Anthropic-compatible and OpenAI-compatible endpoints, including Chat Completions and Responses, and MiniMax says open weights arrive October 23.
On Artificial Analysis's Intelligence Index it scores 42, up from 29 for M3, behind DeepSeek V4.1 Flash 1017 at 45 and level with GLM-5.3-Flash. The Decoder puts its cost per task on that suite at about $0.22 against DeepSeek's $0.26. MiniMax's own table has it at 38.1 on Terminal Bench 4.0, where Opus 5 scores 51.8. The number to remember is from Artificial Analysis: a 93% hallucination rate, meaning that when it doesn't know, it tends to answer anyway.
For builders
Because it accepts Anthropic-format requests, you can test it by pointing one sub-agent's base URL at MiniMax and leaving everything else alone. Give it the bulk work where you can check the output (classification, reformatting, first-pass summaries) and keep it away from factual answers that don't come with retrieval. Log cost per finished task, not per token, before you move more traffic.
Story IV
Cloudflare's Clairic extracts fields from text and images at $0.10 per million input tokens, with free output
Cloudflare put Clairic in preview on Workers AI as @cf/cloudflare/clairic. You give it text or up to four images plus the fields you want, and it returns typed values as JSON in one pass: text, numbers, dates, durations, lists, even estimates and forecasts. It returns null when a value is missing and a confidence score with each value. Context is 65,536 tokens. Input costs $0.10 per million tokens and output is free. Cloudflare hasn't disclosed the parameter count, and open weights are "set to follow soon."
Cloudflare's example is a damaged-product claims pipeline. Extraction took 0.46 seconds with Clairic against 16.1 seconds with GLM-5.3, and the full chain finished in 19.3 seconds against 61.7. Cost per million claims fell 49%, from $11,740 to $6,032. Those are Cloudflare's numbers on Cloudflare's pipeline. It also says plainly that long chains of arithmetic and totals across many table rows aren't reliable yet.
For builders
Find the step in your app where a big model reads an invoice, receipt or form only to fill a JSON schema, and run 100 real documents through env.AI.run("@cf/cloudflare/clairic", ...) beside your current call. Compare field by field. Do the sums and totals in your own code, and send anything under your confidence threshold back to the LLM. That split is where Cloudflare's speedup came from.
— The Vibe Gate news desk. We read the firehose so you can keep building.