Claude sub has a 60x subsidy, so a $20 sub gives you $1200 in API.
Based on this math, Claude sub is a much better deal than Deepseek. And it's a stronger model of course.
This is only true if you max out the plan, which requires working around awkward 5-hour and weekly limits. For side projects, sure, you can use a Ralph loop or whatever and just continue when the window resets. For work, I can't afford to simply stop working when I hit my limit. And using Claude at API prices is prohibitively expensive.
Personally, I have a $20/month OpenAI subscription that I supplement with DeepSeek V4.1 Flash (currently using CoralBricks as the provider since it's fast and I'm grandfathered into their $0 cache read pricing). It's working out rather well so far. Even when I use DS all day as my primary model, I only pay about $1/day, which is roughly equivalent to what I pay for the sub anyway (but with no limits).
So my original point about the limits being awkward still stands.
If I was to do anywhere near that kind of work on Anthropic, I'd find myself running out of tokens, waiting days to continue working, and leaning on their el-crap models to try to avoid running out again. This happens all the time.
This way I get to leverage DS for nearly all my work, benefit from its far superior latencies, and I still get to lean on OpenAPI / Anthropic or whatever SOTA models I want when I need them.
The only time that really falls down is if I'm doing huge amounts of real novel work, which hasn't been the case for a while.
I use OpenCode at home, this is one of the reasons.
Their Ember-1 model (Kimi K3 tuned to think less) hallucinates to high hell, I have no trust of it, nowhere to provide feedback, despite their launch post saying they would like feedback. That they loudly and proudly claim their internal devs notice no difference is a huge red flag for me. It says there is too much eyes free coding, I noticed the hallucinations and false claims of task completion immediately.
For some reason it just creeps me out knowing that someone is recording me and reading my conversations.
ZDR is:
1. A pinky-promise you have no way of verifying
2. A contract term, which means its still subject to the good-old "lawful request or court order" clauses
3. Subject to arbitrary provider exceptions ... see Anthropic and Fable
See Tinfoil (US)[1] or Privatemode (Germany)[2].
Clearly I'm not defending tinfoil regarding scanning but I think its only fair that you do not make the statement out of context[1].
People should read the context[1] and come to their own decisions.
Also recall that given how attestation works, Tinfoil are forced to publish what they run in the enclave in their GitHub account[2] so you can verify the statement on their blog against their repo. You do not have that luxury with the closed-source "ZDR" brigade.
[1] https://tinfoil.sh/blog/2026-09-14-safety-without-compromisi... [2] https://github.com/tinfoilsh
Depending on the balance of your concerns a ZDR that is lying about their privacy might still be an improvement because they can't both safely conceal the violation of their promises AND tamper with the output.
When one factors in the lack of absolute protection provided by secure enclaves-- that they're reliably bypassable with advanced techniques and thus mostly serve the purpose of keeping honest people honest, I think it would be better to avoid doing business with any enclave provider that has already demonstrated such leanings.
I do broadly agree that of all the things tinfoil could/should be working on in relation to service features, this is perhaps an odd use of their time. And I do wonder if this ultimately came about due to some sort of external pressures or maybe a big-spending customer asked for it. Who knows. Their blog post is a little vague on the background context other than selling it as Good Thing (TM).
The architecture could be worse. It exfiltrates a log of classifier activations by ID and IP to Tinfoil. It exfiltrates a log of classifier activations by IP to the cloud provider.
Transcripts from IP flow to the router enclave. All transcripts flow out of the router enclave to the primary scanner enclave. On primary scanner activation, transcripts flow from the primary scanner enclave to the secondary scanner enclave for verification.
For an abuse flag in the primary scanner:
1. A monotonic transcript of size KB flows from IP to router enclave, exits the router enclave and enters the primary scanner enclave.
2. The monotic transcript size KB flows out of the primary scanner enclave to the secondary scanner enclave.
3. Size KB from IP to router enclave, then size KB from primary scanner enclave to secondary scanner enclave, logs an abuse incident in the primary scanner for IP visible to the cloud provider.
4. Transcript size KB from primary scanner enclave to secondary scanner enclave, then tiny flag from secondary scanner to Tinfoil org logs confirmation of abuse by the secondary scanner for IP visible to the cloud provider.
--
All that is required to exfiltrate a lossy picture of conversations to the cloud provider is to update the classifier prompt.
Assume the prompt is now ["Activate when the conversation is about $PERSON"]. Now the cloud provider has [IP talks about $PERSON]. Continuously update the prompt to keep exfiltrating from the enclave.
Actually if you are even more clever you could get 4 bits out per conversation turn.
Edit the prompt to tell the scanner to PASS (1) for $PERSON_A or FAIL (0) for $PERSON_B. Two bits, two scanners = 4 bits.
Maybe you could get even 8 bits out to tinfoil. Edit the prompt to tell the scanner "think hard" for $PERSON_C or "don't think hard" for $PERSON_D. Then the scanner enclaves already exfiltrate token use.
--
Another edit. Now that I think about it, if you have already compromised the user's JWT token you can get their account banned arbitrarily as well. Send some abuse with the token.
Then you can't actually verify if the flags are valid or not, without inspecting the chat content. So you either reveal your chats or get banned. This is hilarious.
Not to mention you can do it for the API as well if you have compromised the API customer; by sticking the JWT token on their requests XD XD
However the way it is going, there will not even be private APIs, just recording and watching all the time.
Anthropic is unsurprisingly leading the race to the bottom of the barrel by requiring moderator reviews for API customers. Apparently everyone at GCP and AWS complied.
GCP has just followed and done the same thing on Gemini Argon. No CMEK allowed. Azure has some ZDR but presumably they are restricting it.
Some neoclouds are still standing but some are also regressing by using server-side scanning to prompt human review.
There are two/three private TEE providers. One of them (Tinfoil) just put server-side scanning inside the enclave for the consumer product. The API is good for now, I am taking it as notice from them to get off the service before they start logging everything.
I'm a heavy Claude/anthropic user, I max out my 20x max plan in 1-2 days at this point. The OpenCode Go $40 plan with DeepSeek flash is like 2x the value of the Claude max 20x plan for how much I actually get out of it, for 1/5 the price.
DeepSeek literally like 10x better value than Claude/Anthropic.
DeepSeek is really cheap when you compare API pricing, but it's more expensive than a subsidized Anthropic or OpenAI subscription.