Cursor's Secret: Composer 2 Is Built on China's Kimi K2.5

March 20, 2026 · AI Tools

The Launch and the Discovery

On March 19, 2026, Cursor — the AI-powered IDE valued at $50 billion — launched Composer 2, billing it as a breakthrough in long-horizon coding. The announcement was framed as a new proprietary model trained specifically for complex, multi-file software engineering tasks.

Within hours, a developer spotted an internal model identifier in Cursor's API traffic: kimi-k2p5-rl-0317-s515-fast. The post hit 444,000 views on X in under 24 hours. Composer 2 was not a novel model — it was Kimi K2.5 with additional training on top.

Cursor co-founders Aman Sanger and Lee Robinson quickly acknowledged the situation. Sanger admitted: "It was a miss to not mention the Kimi base in our blog from the start."

What Is Kimi K2.5?

Kimi K2.5 is a 1-trillion-parameter Mixture-of-Experts (MoE) model released by Moonshot AI in January 2026. It activates only 32B parameters per inference, has a 256K token context window, and supports native image and video understanding. On SWE-Bench, it scores 76.8% — matching Claude Opus 4.5.

Moonshot AI, founded in 2023 by Tsinghua University alumni, was valued at $18 billion in March 2026 after raising a $1 billion funding round. Cumulative revenue in the 20 days following K2.5's launch exceeded Moonshot's entire 2025 total.

The Architecture: 25% Kimi, 75% Cursor

Cursor's team clarified the technical breakdown: roughly 25% of compute comes from the Kimi K2.5 base model, while 75% derives from Cursor's own continued pre-training and Reinforcement Learning (RL) optimized for long-horizon coding. The RL pipeline specializes the model on multi-file edits, test-driven development, and agentic code execution — tasks where general-purpose frontier models still underperform.

The Kimi K2.5 model is distributed via Fireworks AI, a US inference provider, under an authorized commercial license from Moonshot AI.

The License Problem

Kimi K2.5 uses a modified MIT license with one key clause: products exceeding 100 million monthly active users or $20 million in monthly revenue must display the model name prominently in the user interface. Cursor's $2 billion ARR — roughly $167 million per month — puts it far over this threshold.

Moonshot AI confirmed the partnership was authorized and that licensing terms were being followed. However, Cursor's UI displayed only "Composer 2" with no Kimi attribution — a point of ongoing community debate about whether the spirit of the open-source attribution clause was upheld.

What This Reveals: The Global AI Supply Chain

The Cursor-Kimi controversy is not an isolated incident. It exposes a structural reality of the 2026 AI landscape: American AI products routinely run on Chinese open-weight models. The AI supply chain is global — a product built in San Francisco may be trained in Beijing.

Kimi K2.5 is not the only Chinese model powering US tools. DeepSeek V3, Qwen 3.6-Plus, and Hunyuan variants all appear in various US applications. The combination of Apache 2.0 or MIT licenses and state-of-the-art benchmark performance makes these models attractive infrastructure for Western startups.

The implications for enterprise buyers are real. Companies with data residency requirements, government contracts, or supply chain audits need to understand what model is actually serving their requests — not just what the product interface shows.

Moonshot AI at $18 Billion

The controversy boosted Moonshot AI's public profile significantly. The $18 billion valuation — a 4x increase from $4.3 billion in January 2026 — reflects not just Kimi K2.5's performance but its commercial traction. Cursor, Fireworks AI, and multiple enterprise integrations validate the model at scale.

Moonshot AI stated the Cursor incident "aligns with our goals for the open model community" — a pointed reminder that open-source strategies can generate attribution and brand leverage even when products are sold under different names.

Why This Matters for Developers

If you are paying for an AI coding tool, you deserve to know what model is generating your code. The Cursor situation illustrates why model transparency matters — for security, compliance, and informed product choices. Tools like Happycapy are explicit about which model is active: you select Claude, GPT-5.4, Gemini, or Kimi directly, with full transparency per request.

Multi-model access also means you are not locked into one vendor's choices. As the supply chain becomes more complex, the ability to switch models gives you control over cost, capability, and compliance.

What Happens Next

Cursor has updated its product page to acknowledge Kimi K2.5 as the base model for Composer 2. The broader developer community is pushing for industry-wide standards on model attribution, similar to ingredient labels on food products.

Moonshot AI is reportedly building a licensing program for commercial use of Kimi models, with tiered attribution and revenue-sharing arrangements for enterprise deployments. Expect similar programs from other Chinese open-source labs as their models penetrate Western commercial stacks.

Frequently Asked Questions

What is Cursor Composer 2?

Composer 2 is Cursor's advanced AI coding agent, launched March 19, 2026, for long-horizon coding tasks. It is built on Kimi K2.5 by Moonshot AI, with 75% of compute from Cursor's additional RL fine-tuning.

What is Kimi K2.5?

Kimi K2.5 is a 1-trillion-parameter MoE model by Beijing-based Moonshot AI, released January 2026. It scores 76.8% on SWE-Bench and is competitive with Claude Opus 4.5.

Did Cursor violate the license?

Moonshot AI confirmed the partnership was authorized. However, Kimi K2.5's modified MIT license requires prominent UI attribution for products earning over $20M/month — a requirement Cursor's $167M/month ARR clearly triggers.

What does this mean for enterprise users?

Enterprise buyers with compliance or data-residency requirements need to audit the model supply chain behind their AI tools. The AI powering your product may not be what the brand implies.