Cursor released Composer 2 around March 19. The tool was positioned as a high-performance coding model competitive with frontier alternatives. What wasn’t in the announcement: Composer 2 runs on Kimi K2.5, an open-weight model from Moonshot AI, a China-based AI lab. Cursor didn’t disclose the foundation model at launch. A developer discovered it. Then TechCrunch reported that Cursor admitted the underlying model was built on top of Moonshot.
The non-disclosure is the story. Composer 2 launched with pricing ($0.50 per million input tokens, $2.50 per million output tokens, per cursor.com) and benchmark comparisons. According to vendor-reported benchmarks cited by thenewstack.io, Composer 2 scores 58.0 on Terminal-Bench, outperforming Claude Opus 4.6 on that measure but trailing GPT-5.4 (75.1). These are self-reported scores, no independent evaluation from Epoch AI or equivalent has been published. The performance claims may hold up. That’s separate from whether Cursor should have told its users what they were actually running.
Kimi K2.5 is publicly available as an open-weight model. Using it as a foundation is legal. Rebranding it without disclosure is not a regulatory violation in any jurisdiction with current rulemaking. It is, however, a trust decision, and one with real consequences for enterprise buyers. Reports on developer forums suggest a potential licensing dispute between Cursor and Moonshot AI regarding whether appropriate permissions were obtained; this hasn’t been independently confirmed and should be treated as unverified until a named source confirms it.
The enterprise implications are immediate. Organizations using Cursor in their engineering workflows are now running code queries through a model they may not have known was developed by a Chinese AI lab. That’s not inherently a problem, open-weight model provenance doesn’t automatically create security risk. But enterprise procurement policies often require knowing what’s in the stack. Supply chain transparency in AI tooling has been an aspirational norm. This case demonstrates the gap between aspiration and practice.
The developer community response, surfaced across technical forums, reflects genuine frustration. The issue isn’t the model. The issue is that the vendor made a choice about what developers deserved to know, and the answer was: not this. That’s the trust variable enterprises need to factor into their Cursor evaluation going forward.
What to watch: whether Cursor provides a full disclosure statement, whether Moonshot AI confirms or denies the licensing question, and whether other AI coding tool vendors are examined for similar undisclosed foundation model use. Composer 2 may be the first case. It probably isn’t unique.
For developers and engineering teams: the right question isn’t whether to keep using Cursor. It’s whether your vendor transparency requirements are explicit in your procurement policies. If they weren’t before today, they should be now.