- Cursor’s Composer 2, launched March 19, 2026, was built on Kimi K2.5 from Beijing-based Moonshot AI — a fact the company initially did not disclose in its announcement blog post.
- A developer discovered the base model by inspecting Cursor’s API traffic and finding the model ID “kimi-k2p5-rl-0317” in network requests.
- Kimi K2.5’s license requires products exceeding $20 million in monthly revenue to display attribution. Cursor’s reported monthly revenue of approximately $167 million substantially exceeds that threshold.
- Cursor co-founder Aman Sanger acknowledged: “It was a miss to not mention the Kimi base in our blog from the start.”
What Happened
On March 19, 2026, Cursor released Composer 2, its latest AI coding model. The announcement blog post described the model as built through “continued pretraining” and “reinforcement learning,” language that implied proprietary development from scratch. It made no mention of an external foundation model.
Days later, a developer named Fynn inspected Cursor’s API traffic and found the model identifier accounts/anysphere/models/kimi-k2p5-rl-0317-s515-fast, revealing that Composer 2 was built on top of Kimi K2.5, a model developed by Beijing-based Moonshot AI. The discovery spread rapidly after Elon Musk amplified it on X with three words: “Yeah, it’s Kimi 2.5.”
Cursor co-founder Aman Sanger responded publicly: “It was a miss to not mention the Kimi base in our blog from the start.” A Cursor VP of Developer Education added: “Yep, Composer 2 started from an open-source base!” The blog post has since been updated to credit Kimi K2.5 as the foundation model.
Why It Matters
The incident exposed a recurring pattern in the AI industry. Cursor’s previous model, Composer 1, was also built on a Chinese foundation — DeepSeek — without upfront disclosure. The lack of transparency is not unique to Cursor. Chinese open-source models from labs like DeepSeek, Moonshot AI, Alibaba’s Qwen, and Zhipu’s GLM increasingly form the foundation of Western AI products, often without public attribution or clear communication to users about the model’s origins.
For enterprise customers running Cursor in production environments, the undisclosed dependency on a Chinese-developed model raises questions about supply chain transparency, data handling practices, and geopolitical risk assessment. Companies with security policies restricting foreign-sourced AI in their development toolchain now have a retroactive compliance question to address. The broader concern is that no industry standard currently exists for disclosing base model provenance in fine-tuned commercial products.
Technical Details
Kimi K2.5 is a 1-trillion-parameter model with 32 billion active parameters and a 256,000-token context window, developed by Moonshot AI in Beijing. According to Cursor, approximately 25% of the total compute used to build Composer 2 came from the Kimi base, with the remaining 75% from Cursor’s own continued pretraining and reinforcement learning fine-tuning.
The resulting model shows substantial performance improvements. Composer 2 scores 61.3 on CursorBench, up from 44.2 for Composer 1.5 and 38.0 for Composer 1. It achieves 61.7 on Terminal-Bench 2.0 and 73.7 on SWE-bench Multilingual. The model is priced at $0.50 per million input tokens and $2.50 per million output tokens, with a faster variant available at $1.50 and $7.50 respectively. Cursor published a technical report on the training methodology at arxiv.org/abs/2603.24477.
Who’s Affected
Cursor’s user base spans individual developers and enterprise engineering teams. Moonshot AI later characterized the arrangement as an “authorized commercial partnership” facilitated through the inference provider Fireworks AI, but the initial non-disclosure undermined trust with users who assumed the model was developed entirely in-house by Cursor’s team.
The licensing question adds a concrete compliance dimension. Kimi K2.5’s modified MIT license requires products exceeding $20 million in monthly revenue to prominently display “Kimi K2.5” in their user interface. Cursor’s reported monthly revenue of approximately $167 million substantially exceeds that threshold. Whether Cursor’s commercial partnership with Moonshot AI supersedes this requirement has not been publicly clarified.
What’s Next
Cursor has updated its blog post to credit the Kimi base, and Moonshot AI has publicly acknowledged the commercial partnership. The broader issue remains unresolved. As open-source AI models from Chinese labs continue to rank among the most capable and permissively licensed foundations available, more Western companies will face the same decision about whether and how to disclose their model’s origins. Until an industry norm or regulatory requirement for base model attribution emerges, the pattern of discovery-after-launch is likely to repeat across the AI tooling ecosystem.
