A leaked API call just exposed Cursor's biggest secret

Cursor told the world it built its own AI coding model. A developer just proved it didn't.

On March 19, Cursor — the $29.3 billion AI coding editor — launched Composer 2, marketing it as a proprietary model that beats both Claude Opus 4.6 and GPT-5.4 at writing code. The announcement touted "continued pretraining" and "scaled reinforcement learning" (a technique where AI learns by trial and error, not memorization). Nowhere did it mention Kimi K2.5 — a free, openly available AI model built by Chinese startup Moonshot AI.

Then a developer named Fynn peeked behind the curtain.

The Model ID That Changed Everything

While testing Cursor's API (the connection point where apps talk to AI models), Fynn spotted the internal model identifier that Cursor never meant users to see:

accounts/anysphere/models/kimi-k2p5-rl-0317-s515-fast

Every piece of that ID tells a story:

In short: Cursor took an existing Chinese AI model, added extra training for coding tasks, and shipped it as its own creation.

Moonshot AI Fires Back

The revelation sparked an immediate response. Yulun Du, Moonshot AI's head of pretraining, publicly questioned Cursor's compliance. Two Moonshot employees initially confirmed on social media that Cursor lacked proper licensing — then deleted their posts.

The issue centers on Kimi K2.5's license. While the model is free to download and use, the license includes a clause specifically designed for situations like this:

Cursor's announcement blog post, release notes, and model documentation mention Kimi K2.5 exactly zero times.

The Numbers Behind the Controversy

Despite the controversy, Composer 2's performance is real. On coding benchmarks (standardized tests that measure how well AI writes and fixes code), Composer 2 shows significant gains:

The quality isn't in question. The honesty is.

What Developers Are Saying

The Hacker News discussion (235+ points) split sharply. Some developers argued that "there is no 'just' in RL" — that the reinforcement learning work Cursor did on top of Kimi K2.5 represents genuine engineering effort. Others pointed out that Cursor's entire value proposition just shifted:

"Cursor is mostly an IDE harness company," one developer wrote. "Their moat looks pretty thin."

A Cursor representative referenced vague "inference partner terms" that might shield them from attribution requirements, but provided no specifics. Moonshot AI's license was specifically written to cover fine-tuned derivatives — models that are modified versions of the original.

Why This Matters Beyond Cursor

This case tests a question that affects every AI company: can open-source AI licenses actually be enforced?

Open-weight models (AI models whose internal workings are publicly shared) are the backbone of the AI industry. Companies like Moonshot, Meta, and Mistral release powerful models for free, trusting that commercial users will follow the license terms. If a $29.3 billion company can ignore those terms without consequence, the incentive for any AI lab to share its work openly shrinks dramatically.

For Cursor's 1 million+ daily users, the practical impact is minimal — Composer 2 works well regardless of its origins. But for the broader AI ecosystem, the answer to "does open-source licensing matter?" will shape what gets shared and what gets locked behind closed doors.

Related Content — Get Started with Easy Claude Code | Free Learning Guides | More AI News