What happens when a $29.3 billion coding startup launches a model it calls its own, and the internet figures out where it actually came from?
Cursor released Composer 2 on March 19, positioning it as a purpose-built coding model that beats Claude Opus 4.6 on benchmarks while costing a fraction of the price. The pitch was compelling: $0.50 per million input tokens, a 200,000-token context window (roughly 500 pages of code), and scores north of 60% on CursorBench. Cursor never mentioned another company's model.
Then a developer named Fynn So inspected the API requests. The model identifier Cursor was sending? kimi-k2p5-rl-0317-s515-fast. That's Kimi K2.5, built by Chinese AI lab Moonshot AI, with some reinforcement learning on top.
The Attribution Problem
Kimi K2.5 ships under a modified MIT license with one notable clause: any commercial product with a substantial user base or revenue must prominently display "Kimi K2.5" in its materials. Cursor has over one million daily active users and is reportedly raising at a $50 billion valuation. By any reading, that qualifies.
Cursor's announcement credited "continued pre-training and reinforcement learning" for Composer 2's performance but said nothing about Kimi K2.5 as the foundation. Moonshot AI's pretraining head, Yulun Du, publicly confirmed tokenizer similarities and questioned whether Cursor followed the license terms.
As of this writing, Cursor hasn't responded to the allegations.
The Benchmarks in Context
Composer 2's performance claims deserve some scrutiny now. Cursor reported a 61.7% score on Terminal-Bench 2.0, edging out Claude Opus 4.6 at 58.0%. It also outperformed GPT-5.4 in low-configuration mode on CursorBench, though it still trailed GPT-5.4's medium and high modes.
Those are solid numbers. But if Composer 2 is Kimi K2.5 with task-specific reinforcement learning, the story changes. Cursor didn't build a foundation model from scratch. It fine-tuned (additionally trained on specific tasks) an existing one. That's a legitimate engineering approach, but it's a very different claim than "we built a coding model."
The pricing also makes more sense through this lens. At $0.50 per million input tokens, Composer 2 undercuts Claude and GPT-5.4 by a wide margin. Training a competitive foundation model from scratch costs hundreds of millions of dollars. Fine-tuning someone else's model costs dramatically less.
What This Means for Cursor Users
For the million-plus developers using Cursor daily, the model's origin matters less than whether it works. Early reports suggest Composer 2 is genuinely good at code generation and debugging tasks. The pricing is aggressive, and the 200k context window handles large codebases well.
But the licensing situation creates real uncertainty. If Moonshot AI pursues enforcement, Cursor might need to either add attribution, negotiate a separate commercial license, or swap to a different base model. Any of those could affect pricing, performance, or both.
The broader pattern here is familiar: companies fine-tune open-weight models, wrap them in a product, and present them as proprietary technology. It works until someone checks the model ID in the API call.