Cursor launched Composer 2 on March 19, calling it their new “frontier agentic coding model.” The benchmarks looked impressive—61.7% on Terminal-Bench 2.0, beating Claude Opus 4.6’s 58.0%. The price was even better: $0.50 per million input tokens, roughly 10x cheaper than Opus.
Then a developer intercepted Cursor’s API traffic and found the model ID: kimi-k2p5-rl-0317-s515-fast.
Composer 2 is Kimi K2.5 from Moonshot AI—a Chinese startup backed by Alibaba, Tencent, and HongShan. Cursor’s marketing mentioned none of this.
How It Was Discovered
Within hours of the launch, a developer named Fynn ran Cursor through a debug proxy. The model identifier appeared in plaintext in the API calls. The “in-house” model was calling Moonshot’s infrastructure.
The discovery spread quickly on Hacker News and X. Cursor’s VP of Developer Education, Lee Robinson, confirmed the Kimi connection within hours. Co-founder Aman Sanger acknowledged “it was a mistake not to disclose the base model from the start.”
The License Problem
Kimi K2.5 ships under a Modified MIT License with a specific requirement: any commercial product generating over $20 million monthly revenue must “prominently display ‘Kimi K2.5’ in its user interface.”
Cursor’s interface shows “Composer 2.” No Kimi branding anywhere.
Cursor claims they accessed Kimi K2.5 through Fireworks as part of an authorized commercial partnership. Whether that partnership exempts them from the attribution requirement remains unclear. Moonshot AI hasn’t publicly confirmed the arrangement.
The Performance Picture
Setting aside the controversy, Composer 2’s benchmarks are genuinely competitive:
| Benchmark | Composer 2 | Claude Opus 4.6 | GPT-5.4 |
|---|---|---|---|
| Terminal-Bench 2.0 | 61.7% | 58.0% | 75.1% |
| SWE-bench Multilingual | 73.7% | 77.8% | — |
| CursorBench | 61.3% | — | — |
Composer 2 beats Opus on terminal operations. It trails on SWE-bench Multilingual. GPT-5.4 leads on both where tested.
The pricing gap is dramatic:
| Model | Input (per 1M tokens) | Output (per 1M tokens) |
|---|---|---|
| Composer 2 | $0.50 | $2.50 |
| Composer 1.5 | $3.50 | $17.50 |
| Claude Opus 4.6 | $5.00 | $25.00 |
That’s an 86% cost reduction from Cursor’s previous model and roughly 90% cheaper than Opus.
The Security Question
Moonshot AI isn’t just any Chinese company. The U.S. Commerce Department has flagged it for national security concerns. Cursor—a $29.3 billion code editor used by developers at major tech companies—was routing proprietary source code through infrastructure connected to a Beijing-based AI lab.
Cursor says they fine-tuned Kimi K2.5 with reinforcement learning and run inference through Fireworks, a U.S. company. But the base model’s training data, architectural decisions, and potential behaviors were all determined in China.
For enterprise security teams, this raises questions:
- Does your company’s security policy allow code processing by Chinese-developed AI models?
- Did developers know they were using Kimi when they chose Composer 2?
- How should open-source provenance factor into AI tool selection?
What Cursor Got Right
Composer 2 represents genuine progress in autonomous coding. The model handles “long-horizon” tasks—multi-file refactors, test generation, and sequential operations that verify intermediate results. A 200,000-token context window accommodates large codebases.
The RL fine-tuning appears effective. Cursor trained on hundreds of actions per task, optimizing for the kind of extended reasoning that coding agents need. The result competes with models costing 10-20x more.
What Cursor Got Wrong
The disclosure failure matters more than the China connection.
Open-source AI depends on transparency. When companies build on open models without attribution, they undermine the ecosystem that produced those models. Kimi K2.5’s Modified MIT License explicitly requires prominent branding—presumably because Moonshot AI wanted credit for their work.
Cursor’s explanation—that they “forgot” to mention the base model—strains credibility for a company valued at nearly $30 billion. Whether this was intentional obscuring or genuine oversight, it damaged trust with developers who care about knowing what’s running their code.
What This Means
The Composer 2 incident reveals two things about the current AI landscape.
First, Chinese open-source models are now competitive with Western proprietary offerings. Kimi K2.5 matches or beats Claude Opus on key benchmarks. Companies can build successful products on Chinese foundations—and the cost advantages are compelling.
Second, the AI supply chain has become opaque. Developers choosing “Cursor’s model” were actually using Moonshot’s model. Enterprise security teams have no reliable way to audit what’s actually processing their code.
What You Can Do
If you’re using Cursor:
- Check your organization’s security policy on Chinese-developed AI models
- Consider whether you’re comfortable with your code passing through Kimi-based infrastructure
- Review Cursor’s privacy policy for data handling details
If you’re evaluating AI coding tools:
- Ask vendors directly about model provenance
- Request documentation on where inference runs
- Factor open-source licensing compliance into vendor assessment
If you work in open-source AI:
- The Kimi incident shows attribution requirements need enforcement mechanisms
- Consider whether “Modified MIT” licenses adequately protect your interests
- Monitor downstream usage of your models
The Bottom Line
Composer 2 is a good coding model at an excellent price. The benchmarks hold up under scrutiny. If you don’t care about model provenance, it’s a reasonable choice.
But “don’t care about model provenance” is a significant if. Cursor’s failure to disclose Kimi K2.5—combined with Moonshot AI’s security concerns—raises questions that go beyond this particular launch.
The AI coding market now includes Chinese models that match Western performance at a fraction of the cost. How developers and enterprises respond to that reality will shape the tools we use for years to come.