Cursor, one of the fastest-growing AI coding tools in the world, found itself at the center of a controversy after releasing its new model, Composer 2, without disclosing that it was built on a Chinese open-source foundation.
Launched on March 18, Composer 2 was presented to the public as a frontier-level coding model available at a notably low cost. Cursor described it in terms that led most users to believe the company had built it from the ground up. No mention was made of any open-source base, and certainly no mention of China.
That changed quickly. A user named Fynn noticed that internal URLs were still referencing the model as Kimi K2.5, a high-performing open-source model developed by Moonshot AI, a Chinese company.
The discovery spread rapidly across Reddit, X, and other social media platforms.
Even Elon Musk weighed in, confirming the connection.
Kimi K2.5 is released under a modified MIT license. For smaller companies and individual developers, attribution is not required. However, the license includes a threshold clause: organizations with over 100 million monthly active users or over $20 million in monthly revenue must prominently disclose that their product is built on the model. Cursor, valued at close to $30 billion and reportedly generating over $2 billion in annualized revenue, clearly falls within that requirement.
A Cursor employee named Lee Robinson acknowledged that Composer 2 “started from an open-source base” but still stopped short of naming Kimi directly.
He added that roughly one quarter of the total compute used came from the base model, with the remaining three quarters going toward Cursor’s own reinforcement learning training. He also stated that Cursor was following the license through its inference partner, Fireworks AI.
An engineer at Moonshot AI briefly posted that the Kimi team had tested the Composer 2 API and confirmed the tokenizer was identical to their own, adding “we are surprised that Cursor AI did not respect our license, nor did they pay us any fees.”
That post was later deleted, replaced by an official Moonshot statement congratulating Cursor and describing the arrangement as part of an authorized commercial partnership through Fireworks AI.
So what actually happened here? Cursor did not simply relabel someone else’s work. The reinforcement learning training they built on top of Kimi K2.5 is real, technically sophisticated, and well documented in a blog post they later published.
Their self-summarization approach, which allows the model to compress context mid-task and continue working across long coding sessions, is a genuine innovation backed by significant compute investment.
The most likely reason Cursor avoided naming the base model comes down to two things: optics and geopolitics. A $30 billion company building on a Chinese model is a PR challenge in the current US-China technology climate, regardless of how much original work went on top of it.
Cursor should have credited Kimi K2.5 from day one. They know that now. The question worth asking is whether they are the first company to do this, or simply the first one caught.
