Cursor’s Composer 2 Exposed as Kimi K2.5 Under the Hood

Cursor’s launch of Composer 2 on March 19, 2026 turned into one of the AI industry’s most public attribution scandals when a developer discovered within hours that the “self-developed” coding model was built on top of Moonshot AI’s open-source Kimi K2.5. The incident has reignited debate over transparency, open-source licensing, and what it means to claim a model as your own.

General Audience

What Happened

Cursor, the AI-powered code editor built by Anysphere (valued at $50 billion), launched Composer 2 with bold claims: 61.7% on Terminal-Bench 2.0, beating Anthropic’s Claude Opus 4.6 (58.0%) at one-tenth the price. The company described it as their “first continued pretraining run” with “long-horizon coding tasks through reinforcement learning.”

Within hours, developer @fynnso spotted a telltale model identifier in Cursor’s API responses: accounts/anysphere/models/kimi-k2p5-rl-0317-s515-fast. The name decoded cleanly: kimi-k2p5 (Kimi K2.5 base model), rl (reinforcement learning), 0317 (March 17 training date), fast (optimized serving). The post garnered over 444,000 views in 24 hours. Elon Musk amplified the discovery, quoting the post with: “Yeah, it’s Kimi 2.5.”

Moonshot AI’s head of pre-training, Yulun Du, independently confirmed the connection by running tokenizer analysis showing an identical match between Composer 2 and Kimi K2.5.

The Licensing Problem

Kimi K2.5, released by Beijing-based Moonshot AI (backed by Alibaba and HongShan) in January 2026, uses a Modified MIT License with a critical clause: any product with more than 100 million monthly active users or more than $20 million in monthly revenue must “prominently display ‘Kimi K2.5′” in its user interface.

Anysphere’s numbers put it squarely above both thresholds. The company reports annual recurring revenue exceeding $2 billion — roughly $167 million per month, more than eight times the licensing trigger. Cursor displayed only “Composer 2” in its interface with no mention of Kimi.

How Both Sides Responded

Cursor co-founder Aman Sanger acknowledged the omission: “It was a miss to not mention the Kimi base in our blog from the start.” Vice president of developer education Lee Robinson elaborated that only about 25% of Composer 2’s compute came from the Kimi K2.5 base, with 75% from Cursor’s own reinforcement learning training. Robinson argued that compliance was handled through Cursor’s inference partner, Fireworks AI, under authorized commercial terms.

Moonshot AI’s response evolved from internal tension — two employees initially confirmed the violation publicly before deleting their posts — to an official endorsement. The Kimi team’s official account ultimately congratulated Cursor, calling it part of an “authorized commercial partnership” with Fireworks AI. Cursor committed to crediting the base model upfront in future releases.

Why It Matters

The incident exposes a growing tension in AI development: open-source models are increasingly the foundations of commercial products, but attribution and licensing compliance often trail behind marketing. Cursor’s technical contribution — the reinforcement learning fine-tuning that produced strong coding benchmarks — is real. But presenting a derivative model as “self-developed” without disclosing the base erodes the trust that makes open-source ecosystems work.

For the broader AI community, the Composer 2 episode is likely to accelerate calls for clearer provenance tracking in model releases and more robust enforcement of open-weight licensing terms.

Related Coverage

• Moonshot AI Releases Kimi K2.5 with Agent Swarm and Frontier Vision — our coverage of the original Kimi K2.5 release
• Alibaba-backed Moonshot Unveils Kimi K2 — the earlier Kimi K2 open-source release
• Anthropic Exposes Industrial-Scale Distillation Attacks by DeepSeek, Moonshot, and MiniMax — Moonshot’s involvement in the distillation controversy

Sources

• Cursor admits its new coding model was built on top of Moonshot AI’s Kimi — TechCrunch
• Cursor’s Composer 2 Is Kimi K2.5 With RL — And No Attribution — Awesome Agents
• What Model Is Cursor’s Composer 2.0? The Kimi K2.5 Controversy — Recording Law
• Cursor Composer 2: Claims, Evidence, and What It Means — NovaKnown
• Cursor “Shell” Kimi Controversy Reversed — BlockBeats