Summary: Cursor launched Composer 2 on March 20, 2026, but a developer found an API model ID tying it to Kimi K2.5 open weights, and Cursor confirmed the lineage two days later. The article says the use appears license-compliant under Modified MIT, yet nondisclosure created a trust and procurement problem. It recommends adding model-provenance disclosure to vendor evaluation and assuming public model origins will eventually be reconstructed.
Cursor put Composer 2 in front of the world on March 20, 2026, billing its flagship in-house model as a leap to frontier-level coding intelligence. Barely hours passed before a developer writing under the name Fynn pulled an internal model ID out of Cursor’s API traffic: kimi-k2p5-rl-0317-s515-fast. One stretch of that string — k2p5 — gave the game away: underneath Composer 2 runs Kimi K2.5, Moonshot AI’s open-weights model.
Then on March 22, Cursor came clean: Composer 2 takes Kimi K2.5’s open weights as its starting point and applies large-scale reinforcement learning from there. A sector-wide argument blew up over open-source attribution, marketing transparency, and how much weight the phrase “our own model” is allowed to carry. The fight itself was over in days; the questions it surfaced will trail the open-weights ecosystem for a long while yet.
The Secret a Leaked Model ID Gave Up
Model fingerprinting is an established craft among developers: pose identity questions, watch for formatting habits and characteristic failure modes, then hold the response profile against known models. Fynn’s route was far more direct — an unvarnished model ID slipping out through API responses peeled the packaging off in one stroke, with the RL suffix and the date stamp (0317) even sketching out the training timeline.
The episode lands on a hard truth: in the API era, keeping a model’s origins hidden for long is close to impossible — inference infrastructure details, response fingerprints, and internal identifiers keep bleeding information outward. A plan resting on “nobody will find out” counts its lifespan in hours.
From Launch to Admission: The Days in Between
- March 20: Composer 2 goes live, marketed as Cursor’s own model
- March 20, evening: Fynn catches the model ID in API traffic; community matching pins the base down as Kimi K2.5
- March 21: Moonshot says it was never informed and received no compensation
- March 22: Cursor confirms Composer 2 was trained from Kimi K2.5’s open weights
- March 23-24: Executives Aman Sanger and Lee Robinson walk through the split — roughly 25% of compute on the base model, 75% on Cursor’s own training; later reporting has Moonshot describing the arrangement as a commercial partnership brokered through Fireworks AI
There is nothing small about Kimi K2.5: a mixture-of-experts design with roughly 1 trillion total parameters, about 32 billion of them active, and a 256K context window. The engineering Cursor stacked on top is real work — but the launch announcement gave “built from open weights” not a single mention.
Compliant Under the License, Broken on Trust
Kimi K2.5 is governed by a Modified MIT license: commercial use costs nothing below a scale threshold pegged to monthly active users, and attribution duties begin past it. The legal read-outs that followed largely landed in the same place — Cursor acted within the license, whose terms ask for copyright and license notices to survive and stay silent on whether marketing must name the base model.
The dispute therefore turns not on breach of contract but on a gap in expectations. Users read “our own frontier model” as trained from scratch; what actually existed was open weights plus heavy fine-tuning. The two can both be true — a 75/25 compute split is evidence of real investment — yet nondisclosure still ran up a tab, and the company settled it in credibility over close to a week.
What the “Our Own Model” Story Ends Up Costing
The split over open-source strategy was already on show as the year began (our opening outlook for 2026 carried reports that Meta’s Avocado might turn proprietary); Composer 2 drags a different question into the light: the issue is no longer whether to open-source, but whether you say so once you have built on it.
The ecosystem pays three costs here. First, the commercial standing of open-weight models is held hostage — once “built on open source” reads as something to keep quiet, genuinely open collaborations grow harder to believe. Second, procurement hardens: an enterprise buying a “homegrown model” now adds one more line of due diligence on training provenance and data boundaries. Third, license design comes under pressure: Modified MIT-style terms leave disclosure duties vague, and the community will push fast for clearer norms.
What Developers and Model Buyers Should Carry Away
Three pieces of practical advice. First, put model-provenance disclosure on the vendor evaluation checklist — no law requires it, but this episode has now priced what hiding costs. Second, judge open weights on their own terms: K2.5’s strength as a foundation and Cursor’s packaging of it are separate questions, and folding them together produces bad calls. Third, expect fingerprinting and probing to spread — every team serving a model externally should work from the assumption that the base model’s identity will sooner or later be reconstructed, and design a disclosure strategy up front rather than after being found out.