What Model Is Cursor's Composer 2.0? The Kimi K2.5 Controversy

Cursor's Composer 2.0 runs on Kimi K2.5, a large language model developed by Moonshot AI. A developer discovered the internal model identifier pointing to the Moonshot model within hours of the March 19, 2026 launch, triggering a licensing controversy because Cursor exceeds the thresholds that require prominent Kimi K2.5 attribution in its interface.

What Happened With Cursor Composer 2.0?

On March 19, 2026, Cursor (developed by Anysphere) launched Composer 2.0 to its user base of over one million daily active users. The company positioned the release as a major proprietary advancement in AI-powered code editing.

Within hours, a developer using the handle @fynnso on X (formerly Twitter) posted a discovery that would reshape the conversation. The internal model identifier for Composer 2.0 was visible: accounts/anysphere/models/kimi-k2p5-rl-0317-s515-fast.

That model ID pointed directly to Kimi K2.5, an AI model developed by Moonshot AI, a Beijing-based artificial intelligence company. The tweet received over 444,000 views in less than 24 hours.

The discovery raised immediate questions about what Cursor had actually built, what it had licensed, and whether it was complying with the terms of the model it appeared to be using.

Who Confirmed the Connection?

The link between Cursor Composer 2.0 and Kimi K2.5 was not just community speculation. Yulun Du, Moonshot AI's head of pretraining, posted on social media confirming that a tokenizer analysis matched Kimi K2.5. Du subsequently deleted the post.

A second Moonshot AI employee also posted a confirmation before deleting it. The pattern of confirm-then-delete suggested internal pressure to avoid public commentary on a potential licensing dispute with a high-profile customer or partner.

Independent developers in the community ran their own analyses. They compared tokenizer outputs, model behavior patterns, and response characteristics. The consensus aligned with the initial finding: Composer 2.0 behaves like a fine-tuned version of Kimi K2.5.

What Cursor Claimed vs. What Was Found

The gap between Cursor's marketing and the community's findings is significant. Here is a direct comparison.

This table highlights the core tension. Cursor marketed Composer 2.0 as its own creation. The evidence suggests it is built on top of another company's model, and the licensing terms for that model include specific attribution requirements.

What Is Kimi K2.5?

Kimi K2.5 is a large language model developed by Moonshot AI, a Chinese artificial intelligence company. The model is part of Moonshot's Kimi series and is designed for general-purpose AI tasks including code generation, reasoning, and natural language processing.

Moonshot AI released Kimi K2.5 under a Modified MIT License. This is important because the standard MIT License is one of the most permissive open-source licenses available. It allows almost unlimited use, modification, and redistribution with minimal requirements.

The "modified" part is where the legal questions arise. Moonshot added specific conditions that go beyond the standard MIT License terms.

The Modified MIT License Terms

The Kimi K2.5 license includes all standard MIT License permissions but adds a critical branding requirement. Products that use Kimi K2.5 (or derivative works based on it) must prominently display "Kimi K2.5" in their interface if they meet either of two thresholds:

1. 100 million or more monthly active users, or
2. $20 million or more in monthly revenue

This is not a suggestion or a best practice. It is a contractual obligation written into the license under which the model is distributed. Any company that uses Kimi K2.5 and exceeds either threshold must comply or risk violating the license terms.

Does Cursor Meet These Thresholds?

Cursor's numbers are not ambiguous. Anysphere, Cursor's parent company, has an annual recurring revenue (ARR) exceeding $2 billion. That works out to more than $166 million per month, which is over eight times the $20 million monthly revenue threshold.

Cursor also reports over one million daily active users. While daily active users and monthly active users are different metrics, a product with one million daily users almost certainly exceeds 100 million monthly active users if it has meaningful retention. Even if the MAU figure is lower, the revenue threshold alone triggers the branding requirement.

As of March 20, 2026, Cursor's interface does not display "Kimi K2.5" anywhere.

The Legal Implications

License Compliance Under Copyright Law

Software licenses, including modified open-source licenses, derive their enforceability from copyright law (17 U.S.C. Chapter 1). When a developer or company uses software distributed under a license, they agree to the terms of that license. Failure to comply can constitute copyright infringement.

The Modified MIT License used by Kimi K2.5 is a conditional license. It grants broad permissions, but those permissions are conditioned on meeting the attribution requirement when the usage thresholds are exceeded. If a company fails to meet the condition, the license grant may no longer apply, and continued use could be unauthorized.

How Courts Have Treated Open-Source License Violations

U.S. courts have increasingly treated open-source license violations as enforceable legal claims. In Jacobsen v. Katzer, 535 F.3d 1373 (Fed. Cir. 2008), the Federal Circuit held that open-source license conditions are enforceable under copyright law, not just contract law. This distinction matters because copyright claims carry stronger remedies, including statutory damages and injunctive relief.

More recently, courts have recognized that failing to comply with attribution requirements in open-source licenses can result in the loss of the license itself. Without a valid license, any use of the copyrighted work becomes infringement.

What Could Happen to Cursor?

If Moonshot AI chose to enforce its license, several outcomes are possible:

Demand for compliance. Moonshot could send a cease-and-desist letter requiring Cursor to add "Kimi K2.5" branding to its interface. This would be the simplest resolution but could damage Cursor's brand positioning.

License termination. If Cursor is found to have violated the license terms, Moonshot could argue the license is revoked. Cursor would then need to either negotiate a new license, remove the model, or face infringement claims.

Damages claim. Under 17 U.S.C. Section 504, copyright holders can seek actual damages and profits, or statutory damages of up to $150,000 per work for willful infringement.

Injunctive relief. A court could order Cursor to stop using Kimi K2.5 entirely until it complies with the license terms, which could disrupt service for over a million users.

The practical likelihood of aggressive enforcement is uncertain. Moonshot AI may prefer to have a high-profile company using its model, even without full compliance. But the legal exposure is real.

A Growing Pattern: AI Companies Rebranding Open Models

The Cursor situation is not isolated. Just two days before the Composer 2.0 controversy, Rakuten launched "Rakuten AI 3.0" in Japan. Independent analysis revealed it was DeepSeek V3, an open-source model, with the MIT license file deleted from the distribution.

This pattern extends further. Research shows that six of ten major Japanese AI models are based on either DeepSeek or Alibaba's Qwen model families. In most cases, the companies using these models downplay or omit the connection to the base model.

Why This Keeps Happening

Several factors drive this trend:

Investor pressure. Companies like Anysphere, which has raised approximately $3.5 billion in funding and was pursuing a $50 billion valuation, face pressure to demonstrate proprietary technology. Admitting that a core product runs on someone else's model undermines the narrative of technical differentiation.

Open-source licensing complexity. Many AI models are released under permissive licenses that allow commercial use. Companies may genuinely misunderstand the boundaries, or they may interpret ambiguous terms in their favor.

Detection difficulty. Until recently, it was hard to verify which base model a product used. Tokenizer analysis, response pattern matching, and model fingerprinting techniques are still evolving.

Competitive dynamics. When competitors are all building on the same base models, no company wants to be the first to admit it. The result is an industry-wide reluctance to acknowledge the shared foundations.

Cursor's Background and Business Context

Cursor was founded by four MIT students who built a code editor on top of Microsoft's VS Code. The product gained rapid adoption by integrating AI assistance directly into the coding workflow. Anysphere, the company behind Cursor, reached a valuation of $29.3 billion and an ARR exceeding $2 billion.

The company's value proposition rests on its AI capabilities. If those capabilities come primarily from a third-party model that any competitor could also license, the justification for Cursor's premium pricing and valuation becomes harder to defend.

This context helps explain why the Kimi K2.5 discovery hit so hard. Critics on social media summarized the concern bluntly: "They pass off VS Code as their own editor, and now they pass off Kimi as their own model."

Not everyone agreed with this framing. A significant portion of the developer community responded pragmatically. Their position: "I don't care where the model comes from. I only care how good it is." For these users, the quality of the coding assistance matters more than its origin.

Both perspectives have merit. But neither addresses the legal question. Regardless of whether users care about the model's origin, the license terms still apply.

What This Means for Developers and Users

For Cursor Users

If you use Cursor, the immediate practical impact is minimal. The tool works the same regardless of which model powers it. However, you should be aware that:

• The model powering your coding assistant may change if Cursor faces enforcement action.
• Performance characteristics could shift if Cursor switches to a different base model.
• The controversy raises questions about what data Cursor sends to which model providers.

For AI Tool Developers

If you build products on top of open-source or open-weight AI models, the Cursor situation is a warning. Review your license compliance carefully. Pay special attention to:

• Attribution requirements that activate at certain usage or revenue thresholds.
• Derivative work definitions in the license (the Kimi K2.5 Modified MIT License explicitly covers derivatives).
• Branding obligations that may conflict with your product positioning.

For the Open-Source AI Community

The pattern of companies using open-source models without proper attribution threatens the open-source ecosystem. If model creators cannot trust that their license terms will be respected, they have less incentive to release models openly. This could push more AI development behind closed doors, reducing transparency and competition.

Cursor's Silence and What Comes Next

As of March 20, 2026, Cursor has not issued any public response to the Kimi K2.5 allegations. The company has not confirmed or denied using the model. It has not addressed the license compliance question.

This silence is itself notable. In a situation where the evidence is publicly visible (the model ID is not speculation; it was directly observable), the lack of response suggests the company is evaluating its legal position.

Several possible outcomes exist going forward:

1. Cursor acknowledges and complies. The company adds Kimi K2.5 attribution and continues using the model. This is the cleanest resolution but may affect investor confidence.

2. Cursor switches models. The company moves to a different base model to avoid the licensing issue entirely. This could affect product quality during the transition.

3. Cursor negotiates a separate license. Anysphere could negotiate a commercial license with Moonshot AI that has different (or no) attribution requirements. Given Cursor's revenue, this would likely be expensive.

4. Legal action. Moonshot AI files suit or sends a formal demand. This would force a public resolution and create legal precedent for AI model licensing disputes.

5. Nothing happens. Both companies quietly move on. This is possible but would leave the licensing question unresolved, inviting future disputes.

The Bigger Picture: AI Model Licensing Is the Next Legal Frontier

The Cursor controversy highlights a broader legal challenge. As AI models proliferate and companies build products on top of them, the licensing frameworks governing their use will face increasing scrutiny.

Traditional software licensing, governed by frameworks like the MIT License, the GPL, and commercial EULAs, was designed for conventional software. AI models introduce new complications: What constitutes a "derivative work" when you fine-tune a model? How do you attribute a base model in a product where the model runs invisibly in the background? Do modified open-source licenses hold up in court when applied to neural network weights rather than source code?

These questions do not have settled answers yet. Cases like the Cursor controversy will help define the boundaries. For now, the safest approach for any company using open-source AI models is strict compliance with license terms, even when those terms seem inconvenient.

For a deeper analysis of how open-source AI model licenses work and what developers need to know, see our companion guide: AI Open-Source Model Licensing Legal Guide.

Update: Cursor Acknowledges Open-Source Base (March 20, 2026)

After this article was published, Lee Robinson, a developer at Cursor, posted the first official acknowledgment on X (formerly Twitter):

In a follow-up post, Robinson was more direct, explicitly naming Kimi K2.5 for the first time:

This is the first time anyone at Cursor has explicitly named Kimi K2.5. Robinson's statement also reveals how Cursor claims to comply with the license: through "inference partner terms" with Fireworks AI, the inference provider. This suggests Cursor may argue that the license obligation is satisfied at the infrastructure level rather than in Cursor's own user interface. Whether that interpretation meets the license's requirement to "prominently display 'Kimi K2.5' on the user interface" remains an open question.

The original Composer 2.0 announcement still makes no mention of Kimi K2.5 or any external base model.

Sources: Lee Robinson on X (initial), Lee Robinson on X (follow-up)