Cursor is the most popular AI coding tool in the world right now. In November, it raised $2.3 billion at a $29.3 billion valuation. It is reportedly doing $2 billion in annualized revenue making it one of the fastest-growing software products ever built.

This week, Cursor launched a new model called Composer 2. They called it "frontier-level coding intelligence." They did not mention that it was built on top of a Chinese open-source AI model backed by Alibaba.

A developer on X figured it out in about an hour.

What Composer 2 Actually Is

Composer 2 is Cursor's flagship coding model — the thing that runs when you ask it to write, edit, or debug code. Cursor presented it as their own frontier model, a signal that they are not just a coding interface on top of OpenAI or Anthropic but a serious AI research company in their own right.

What they did not say is that Composer 2 was built on top of Kimi K2.5, an open-source model released in January 2026 by Moonshot AI, a Chinese startup backed by Alibaba and HongShan — the firm formerly known as Sequoia China.

A user named Fynn on X noticed the original Kimi model ID was still visible in the code. They posted it publicly with the comment: "At least rename the model ID."

What Cursor Did and Did Not Do

Cursor's VP of Developer Education, Lee Robinson, confirmed it within hours. He said roughly a quarter of the total compute used to build Composer 2 came from the Kimi base. The other three quarters came from Cursor's own continued training — which is real work, and the blog post they published explains what that work actually was.

Cursor co-founder Aman Sanger: "It was a miss to not menion the Kimi base in our blog from the start. We'll fix that for the next model."

So they built something real on top of Kimi. The use was licensed and legal. And they chose not to disclose it.

What Cursor Actually Built

The technical blog post Cursor published alongside Composer 2 explains a technique called self-summarization. It is worth understanding because it is genuinely novel.
The problem: AI coding agents are working on longer and more complex tasks. Those tasks generate more context than models can hold in their memory at once. When a model hits its context limit mid-task, something has to give.

The naive solution is to just cut off older context, or use a separate model to summarize it. Both approaches cause the agent to lose critical information and make mistakes.

Cursor's approach: train the model itself to summarize its own memory, in the middle of a task, as part of the reinforcement learning process. When Composer 2 approaches its context limit, it pauses, compresses everything it knows down to roughly 1,000 tokens, and continues from that compressed memory. The summaries get rewarded or penalized based on whether they helped complete the task. Over thousands of training runs, the model learns what to keep and what to drop.

The results are real. Self-summarization reduces compaction errors by 50 percent compared to a heavily engineered prompt-based baseline, using one-fifth the tokens.
As a demonstration, they ran Composer 2 on a Terminal-Bench problem called "make-doom-for-mips" — compile the original Doom game for a MIPS processor architecture in a constrained environment. Several frontier models cannot solve it. Composer 2 solved it in 170 turns, self-summarizing over 100,000 tokens down to 1,000 tokens repeatedly across the task.

This is not just a wrapper on Kimi. The three quarters of compute Cursor claims is theirs produced something meaningfully different.

Why They Did Not Mention the Kimi Connection

Cursor did not say so explicitly. The reasons are not hard to infer.

The first is perception. Cursor is valued at nearly $30 billion on the premise that it is an AI research company, not an integration shop. Admitting that their flagship model starts from someone else's open-source base undercuts that story — even if the subsequent training work is substantial.

The second is politics. Kimi K2.5 was built by a Chinese company backed by Alibaba. This is a sensitive moment in the US-China AI relationship. DeepSeek caused a panic in Silicon Valley in early 2025 when it became clear that Chinese labs were producing models competitive with American ones at a fraction of the cost. Cursor has government and enterprise customers who care about supply chain provenance.

Acknowledging a Chinese model foundation would have generated exactly the coverage they received anyway — except they would have been ahead of it instead of behind it.

What Moonshot Said

Moonshot AI's official account on X came out in support of Cursor after the story broke:
"We are proud to see Kimi-k2.5 provide the foundation. Seeing our model integrated effectively through Cursor's continued pretraining and high-compute RL training is the open model ecosystem we love to support."

They confirmed Cursor accessed Kimi through an authorized commercial partnership with Fireworks AI, a model hosting company. Nothing was stolen. No license was violated. Moonshot released Kimi as open-source specifically so companies could build on top of it.

What Kimi K2.5 Actually Is

Kimi K2.5 is not a minor open-source project. It is a 1 trillion parameter model with 32 billion active parameters, released under a modified MIT license that allows commercial use. Its context window is 256,000 tokens. It supports images and video natively.

On benchmarks, it is competitive with the best models in the world — beating GPT-5.2 on several agentic tests, and scoring first among all models on MathVista. It includes an Agent Swarm capability that runs up to 100 parallel sub-agents simultaneously, making it up to 4.5 times faster on complex multi-step tasks.

It is an excellent model. Building on top of it is not an embarrassment. The embarrassment was the silence.

The Larger Question

Cursor is not the only AI product company that builds on top of other people's foundations. The whole industry does this. OpenAI's models are trained on research going back decades and text scraped from the internet. Meta's Llama is trained on data it does not always fully disclose. Every model is built on layers of prior work.

The question is what you say about it.

Cursor chose to say nothing about Kimi until they were caught. They had a technical story worth telling; a Chinese open-source base, three quarters of the compute from their own novel training, a real performance improvement on hard agentic tasks. That is an interesting story. It is more honest than "frontier-level coding intelligence" with no attribution.

The AI arms race narrative, America versus China, Western models versus Eastern models tends to flatten the reality. One of the most-used American coding tools runs on a model backed by Alibaba. The line is not as clean as the narrative suggests.
Cursor will say so next time. Probably because they have to.

Until next time,

Wes “my base model is still Wes Roth” Roth

PS I did a whooole video about this too in case you were wondering: