CURSOR SHIPPED KIMI K2.5 AS THEIR OWN MODEL. HERE'S HOW IT UNRAVELED

On March 19, Cursor announced Composer 2 — described as their "in-house" AI coding model, "frontier-level at coding," benchmarked against Claude Opus 4.6 and GPT-5.4. The blog post credited "continued pretraining" and "reinforcement learning" for the performance gains. It made no mention of Moonshot AI, Kimi, or any open-source base model.

Within 24 hours, a developer intercepting API traffic posted a screenshot. The model identifier in the live response read: kimi-k2p5-rl-0317-s515-fast.

Yulun Du, Moonshot AI's head of pretraining, then posted on X: "Wait. We tested with composer 2 model API and found out the tokenizer is indeed the same with our Kimi tokenizer! We can almost confirm this is our model post-trained further! We are shocked that @cursor_ai did not respect our license nor did they pay us any fees! @mntruell why??"

He tagged Cursor co-founder Michael Truell directly. That post has since been deleted.

Hours later, Moonshot AI posted an official statement in a markedly different tone.

What Kimi K2.5 is, and what its license requires

Kimi K2.5 is an open-weight model released by Moonshot AI, a Beijing-based AI lab founded in 2023 by Yang Zhilin, Zhou Xinyu, and Wu Yuxin — alumni of Tsinghua University. The model has 577 billion active parameters, was trained on 15.5 trillion tokens, and currently ranks 9th on OpenRouter by usage volume. Moonshot released it openly. They attached one condition.

The modified MIT license on Kimi K2.5's weights requires any commercial product or service exceeding either 100 million monthly active users or $20 million in monthly revenue to do two things: display prominent attribution — "Kimi K2.5" — in the user interface, and pay licensing fees.

Cursor crossed $1 billion in annualized revenue in November 2025. The $20 million monthly threshold is not a close call.

Composer 2's announcement contained no attribution. According to Yulun Du's since-deleted post, no fees had been paid either.

Cursor's response

After the model ID became public, Lee Robinson of the Cursor team posted on X: "Yep, Composer 2 started from an open-source base! We will do full pretraining in the future. Only ~1/4 of the compute spent on the final model came from the base, the rest is from our training. This is why evals are very different. And yes, we are following the license through our inference partner terms."

The inference partner referenced is Fireworks AI.

Both claims in that statement warrant scrutiny.

On the compute ratio: open-source licenses don't assess derivative works by the proportion of compute added. The question is whether the final model derives from the licensed work. A reinforcement learning fine-tune built on Kimi K2.5 weights is a derivative of Kimi K2.5 regardless of how much additional training was layered on top. If anything, Cursor's own blog post confirms this — describing "continued pretraining" and "reinforcement learning" applied to a base, without disclosing what the base was.

On the inference partner argument: Fireworks AI is a hosted compute and inference provider. Their terms of service govern service usage, rate limits, and billing arrangements between Fireworks and their customers. They do not govern what obligations Cursor carries under Moonshot's model license. The license attaches to the entity that created and is commercially distributing the derivative — that is Cursor, not Fireworks. Using a third-party inference provider to serve a model does not transfer the licensing obligations for that model to the inference provider.

Asked directly to evaluate Cursor's inference partner claim, Grok concluded: "Following Fireworks inference terms does not relieve Cursor from Kimi K2.5's license obligations... Fireworks provides hosted API inference, but does not supersede Moonshot's model license for derivatives."

The timeline

The sequence of events matters here. Cursor previously listed Kimi K2.5 as a free model in their interface. Users reported it disappeared from the model picker in early February. On March 19, Composer 2 was announced — with no mention of Kimi K2.5 — carrying a per-token price and positioned as Cursor's own model.

Developer @fynnso caught the model ID in API traffic the same day. Yulun Du confirmed the tokenizer match and posted his public accusation tagging Truell. Multiple Moonshot employees posted corroborating confirmations. Within hours, those posts were deleted.

Then came the official Moonshot statement — congratulatory, carefully worded, and striking a very different note than Du's earlier post:

The gap between these two statements — Du's shocked public accusation and the organization's polished congratulations — is the most significant open question this story leaves. Either the commercial partnership was always in place and Du was unaware of it, or a resolution was reached in the hours between his post and the official statement. Moonshot has not clarified which. The deleted posts are consistent with both explanations, and with standard legal counsel advice to move disputes out of public view.

What the official statement does not address is the attribution requirement. "Authorized commercial partnership" suggests a fee arrangement has been resolved. Whether Cursor's product now displays "Kimi K2.5" attribution in the user interface — as the license explicitly requires — remains publicly unconfirmed.

What this is actually about

Set aside the question of whether a deal was always in place or was struck under pressure. The more durable issue is what the original announcement communicated — and didn't.

Cursor's Composer 2 blog post described performance gains from "our first continued pretraining run" and reinforcement learning, benchmarked the result against frontier models, and positioned the model as evidence of Cursor's own technical capability. It made no mention of the open-weight model that served as the foundation. Whether or not the commercial terms were satisfied, the presentation implied original work that wasn't entirely original.

This matters because the open-source AI ecosystem runs on a compact: labs release powerful models because open development, they believe, produces better outcomes for everyone. Moonshot released Kimi K2.5 under terms specifically designed to allow free use by researchers and smaller players, while requiring acknowledgment — and compensation — from large commercial operations above clear thresholds. Those thresholds exist because a company raising at a reported $29 billion valuation and a two-person research team are not the same kind of beneficiary.

The community found the model ID in under 24 hours. Posts went up, posts came down, and an official statement followed. Whatever was resolved in those hours, it took public pressure to surface it.

That's worth remembering the next time a frontier-level model launches with an impressive benchmark chart and no mention of where it started.