AI coding startup Cursor launched its new Composer 2 model between March 19-22, 2026, without disclosing that the model was built on top of Kimi K2.5 — an open-source multimodal AI model developed by Chinese company Moonshot AI. The omission drew sharp criticism from developers and the open-source community, prompting Cursor co-founder Aman Sanger to acknowledge the lack of attribution was a “miss.”
Kimi K2.5, released on January 27, 2026, is a mixture-of-experts model with 1 trillion total parameters that activates 32 billion parameters per inference request. The model was trained on approximately 15 trillion mixed visual and text tokens and has performed competitively on coding benchmarks against proprietary models from OpenAI and Anthropic. Cursor fine-tuned Kimi K2.5 to create Composer 2, adding coding-specific optimizations and integrating it into Cursor’s IDE as the default model for code generation and editing tasks.
The controversy centers on attribution rather than licensing. Kimi K2.5 is released under an open-source license that permits commercial use, so Cursor’s use of the model as a foundation is legally permissible. The issue is that Cursor marketed Composer 2 as a proprietary advancement without acknowledging its open-source base — a practice that undermines the trust and reciprocity norms that sustain open-source AI development. When users praised Composer 2’s performance, they were unknowingly crediting Cursor for capabilities that originated in Moonshot’s research.
The incident highlights a growing tension in the AI industry between companies that release models openly and companies that build commercial products on top of those releases. Meta’s Llama, Alibaba’s Qwen, and Mistral’s models have all been used as foundations for commercial products, but most companies that do so explicitly acknowledge the base model. Cursor’s initial silence on the Kimi K2.5 foundation was an outlier that drew disproportionate attention precisely because transparent attribution is the norm.
For Moonshot AI, the episode is complicated. The company benefits from widespread adoption of Kimi K2.5, and Cursor’s use validates the model’s quality for production coding tasks. But the lack of attribution denied Moonshot the visibility and credibility that typically flows back to open-source model creators when their work powers successful products. Sanger’s public acknowledgment that the omission was a mistake suggests Cursor will update its documentation, though no formal attribution change has been announced.
