The Secret Inside Cursor Composer 2: It's Kimi K2.5 All Along

The Discovery That Shook the AI Dev Community

It started with a curious developer poking around API endpoints.

On March 19, 2026, Cursor quietly released Composer 2 — their next-generation AI coding agent, promising dramatic improvements in handling long, complex coding tasks. The announcement was met with excitement: social media lit up with praise, with some even claiming "a 50-person team just beat Anthropic." Bold words. But the real story? It was hiding in a model ID.

Developer @fynnso was experimenting with Cursor's OpenAI-compatible base URL when they spotted something unusual buried in the API response:

accounts/anysphere/models/kimi-k2p5-rl-0317-s515-fast

That string — kimi-k2p5 — wasn't a coincidence. Cursor Composer 2 is built on Kimi K2.5, the open-source model from Chinese AI lab Moonshot AI, further post-trained with reinforcement learning (RL) for coding performance.

What Cursor Said (And Didn't Say)

When Cursor launched Composer 2, their official messaging focused on:

• Continued pre-training for deeper code understanding
• Reinforcement learning to sharpen agentic coding performance
• A new ability to handle long, multi-step coding tasks autonomously

What they didn't say? That the foundation model powering all of this was Kimi K2.5 — an open-source model they neither credited nor, according to Moonshot AI, paid for.

This isn't the first time Cursor has leaned on open-source Chinese models either. Community discussions have long suggested that Cursor Composer 1 was reportedly built on Qwen — another Chinese open-source model. The pattern is becoming hard to ignore.

Moonshot AI Fires Back

Moonshot AI didn't stay quiet. Yulun Du, the company's head of pre-training, went public with a pointed accusation: Cursor used Kimi K2.5 without authorization and without payment.

Du's evidence was technical and damning:

• The tokenizer used in Composer 2 is identical to Kimi K2.5's — a near-impossible coincidence if the models were unrelated.
• The model ID discovered in the API directly references Kimi K2.5.
• Moonshot AI stated they never received payment nor gave permission for commercial use.

The License Problem: A $20M Threshold

Here's where it gets legally thorny.

Kimi K2.5 is open-source, but it uses a modified MIT license with a critical commercial clause:

Commercial products with monthly revenue exceeding $20 million must prominently display "Powered by Kimi K2.5" in the user interface.

Cursor is a highly valued company; reported figures for its valuation vary widely in the press, but at that scale the business almost certainly clears the $20M/month revenue threshold that triggers the attribution requirement. Yet Composer 2 launched with zero mention of Kimi K2.5 anywhere in the product or documentation.

This isn't just a PR problem — it's a potential license violation with real legal consequences.

The Bigger Picture: Open Source AI's Governance Crisis

This incident exposes a growing tension in the AI industry. It raises serious questions about AI governance and model attribution — what happens when a high-profile product leaves a model ID visible, and what that means for the entire open-source AI ecosystem.

The community reaction has been sharp and divided:

• Some argue Cursor is simply doing what many companies do — packaging open-source work and adding value through fine-tuning and UX.
• Others point out the double standard: when Chinese labs are accused of using Western data without permission, it makes headlines. When an American company uses Chinese open-source models without attribution, the reaction is often more muted.
• Some developers argue that the real moat Cursor has isn't the model itself — it's the usage data and coding context they've accumulated from millions of developers.

What This Means for You as a Developer

If you're a Cursor user, here's the practical takeaway:

1. The model quality is real — Kimi K2.5 with RL fine-tuning is genuinely powerful for coding tasks.
2. Transparency matters — you deserve to know what model is running under the hood of the tools you pay for.
3. Open-source ≠ free for all — licenses have conditions, and the AI industry is slowly being forced to reckon with that.

Final Thoughts

Cursor Composer 2 is impressive. But the story behind it is a cautionary tale about the opacity creeping into AI product development. In a world where open-source models are increasingly the backbone of commercial AI products, the industry needs clearer norms around attribution, licensing compliance, and transparency.

Moonshot AI built something remarkable with Kimi K2.5. They deserve credit — and apparently, a licensing fee too.

The ball is now in Cursor's court.