Cursor Got Caught Using a Secret Chinese AI Model — Here's the Full Story

The Discovery

Within hours, the community reverse-engineered Composer 2 and discovered it wasn't using proprietary Cursor technology—it was running on Kimi K2.5, an open-source model by Moonshot AI. Cursor never mentioned this anywhere in their announcement.

Geopolitical sensitivity and valuation pressure

Core Innovation: Self-Summarization

Cursor developed a system that compresses 100,000+ tokens of context down to around 1,000 tokens while preserving the most relevant information. This is genuinely clever and solves a real problem in AI coding.

Reinforcement Learning Training

Cursor applied RL training on top of the base model to improve reasoning and coding capabilities, accounting for 75% of the total compute cost for Composer 2.

Of Composer 2's engineering effort was Cursor's own compute and customization

✓ The Nuance

Cursor built real innovations on top of Kimi K2.5. But they built them on a foundation they didn't create and didn't acknowledge. That's the crux of the controversy.

The Special Terms

Companies with either 100M+ monthly active users OR $20M+ monthly revenue must explicitly disclose their use and provide attribution. This is a reasonable middle ground.

⚠️ Why This Matters

The open-source community's frustration is justified. When someone releases their work for free with specific attribution requirements, and a well-funded company ignores those requirements, that erodes trust. Licensing exists for a reason. This suggests licensing terms only matter if someone can afford to enforce them.

1. Open-source Models Are Production-Ready

Kimi K2.5 isn't a toy—it's capable enough that Cursor built their flagship $30B product on it. Open-source isn't just for hobbyists anymore.

2. Building on Open-Source Requires Real Value

Cursor's 75% compute investment and custom engineering show you can't just take an open-source model and sell it—you need meaningful improvements. But you also need to acknowledge where you started.

3. Geopolitics and Business Incentives Are Real Constraints

This situation wasn't driven by technical limitations. Non-disclosure was a strategic choice. Expect licensing disputes to become more common as companies get bigger and stakes get higher.

4. Attribution Matters More When Models Look Similar

Many models now perform similarly. The real difference is in the platform layer. Knowing which base model you're using becomes critical, not less important.

5. Open-Source Communities Enforce Norms Without Legal Action

Moonshot AI's deleted employee response and community backlash show that people care about attribution even without legal enforcement. That's the open-source ethos at work.

Q: Did Cursor break the law by not disclosing Kimi K2.5?

Legally, this is unclear. The MIT license is a civil contract, and enforcement is generally up to the copyright holder. Moonshot AI hasn't sued. However, Kimi K2.5's modified license explicitly requires disclosure for companies of Cursor's size, so Cursor violated the license terms even if there's no legal enforcement happening.

Q: Could Cursor have licensed Kimi K2.5 properly? Why not?

Yes, absolutely. Many companies negotiate commercial licenses with open-source creators. The fact that Cursor didn't suggests they wanted to avoid those conversations—with Moonshot AI, investors, or regulators. The non-disclosure wasn't a mistake. It was a choice.

Q: Is Composer 2 actually good, or is it just repackaged Kimi K2.5?

It's genuinely good. Cursor added a lot on top: self-summarization, reinforcement learning improvements, and about 75% of the compute. They solved difficult benchmarks that the base model couldn't handle. None of this would be as impressive without Kimi K2.5, but Cursor's achievement is real—just not what they implied.

Q: Why would Elon Musk comment on this? What's his stake?

Elon has publicly been critical of AI direction and runs xAI. He's interested in technical accuracy and sees himself as a truth-teller. His comment wasn't rooted in business conflict—it was pointing out a factual inaccuracy in how Cursor presented their work. His involvement added credibility to the community's discovery.

Q: What does Moonshot AI think about Cursor using their model?

That's complicated. An employee initially posted an angry response, which got deleted, then replaced with a corporate congratulatory message. That sequence tells you a lot. The company probably saw it as validation that their model is production-ready, but resented the lack of acknowledgment. The deleted message suggests internal disagreement about whether to make a public fuss.

Q: Does this mean open-source models can't compete with proprietary ones?

No, actually the opposite. Cursor chose to build on Kimi K2.5 instead of developing their own base model, which shows open-source models are competitive. The real advantage isn't the base model—it's what you build on top. Open-source is good, but the platform and experience layer will likely differentiate products going forward.

Q: Will this hurt Cursor's business or reputation?

The real damage is reputational in the developer community. Cursor still has a good product, and Composer 2 works well. But they lost trust with the open-source community and people who care about honest attribution. For some developers, this makes them think twice about recommending Cursor. Whether that translates to revenue loss is unclear, but this erodes long-term credibility.

Build an AI Tool? Get It in Front of the Right Audience

PopularAiTools.ai reaches thousands of qualified AI buyers.

About PopularAiTools.ai — We track what's actually happening in AI tools and products, not what companies want you to believe is happening. This piece is part of our ongoing effort to cover the real story behind AI launches, the technical choices that matter, and the business incentives that shape what gets built.