March 23, 2026 Cursor’s launch of its Composer 2 coding model drew immediate scrutiny after a developer uncovered evidence that it was built on top of Moonshot AI’s Kimi K2.5. The discovery shifted attention from the model’s benchmark performance and aggressive pricing to questions about attribution, licensing and transparency in commercial AI products.
Composer 2 was introduced on March 19 as a high-performance, cost-efficient coding model, supported by Cursor’s internal CursorBench evaluation framework and new reinforcement learning techniques. The launch positioned the model competitively against systems like Claude Opus 4.6 and GPT-5.4, while significantly undercutting them on price, with input tokens priced at $0.50 per million and output tokens at $2.50 per million.
The model’s origin became public less than a day later when a developer identified the string “kimi-k2p5-rl-0317-s515-fast” in an API response. The identifier pointed directly to Kimi K2.5, an open-weight model from Moonshot AI, including details about its training method and versioning. The finding quickly gained traction online, drawing hundreds of thousands of views and prompting public analysis from Moonshot engineers.
Moonshot initially raised concerns about potential licence violations. Kimi K2.5 is distributed under a modified MIT licence requiring companies with more than $20 million in monthly revenue to prominently display attribution if the model is used in commercial products. Cursor’s reported revenue exceeds that threshold, and its interface labels the model as Composer 2 without referencing Kimi.
The situation evolved when Moonshot later confirmed that Cursor’s use of Kimi K2.5 is part of an authorised commercial partnership via Fireworks AI, which provides the hosting and inference infrastructure. Cursor subsequently acknowledged that Composer 2 was built on an open-source base and explicitly named Kimi K2.5 after initial public pressure.
Beyond the attribution issue, Cursor’s technical contributions remain central to the launch. The company introduced “compaction-in-the-loop” reinforcement learning, a method that integrates context summarisation directly into the training process.
According to Cursor’s published results, this approach reduces summarisation errors by 50 per cent and improves token efficiency by roughly five times compared to traditional methods, enabling longer, multi-step coding tasks without losing context.
Cursor also released CursorBench, an internal benchmark designed to address limitations in existing public evaluations such as SWE-bench. The framework uses real-world developer tasks sourced from production sessions, emphasises ambiguous prompts that reflect actual usage patterns, and evaluates models across correctness, code quality, efficiency and interaction behaviour. It also introduces token efficiency as a core metric, reflecting real-world cost and latency trade-offs.
The incident highlights a shift in the AI coding ecosystem. Multiple companies are building products on top of open-weight models while differentiating through fine-tuning, infrastructure and user experience rather than base model development. Industry data shows increasing adoption of such models, particularly where they offer competitive performance at lower cost.
At the same time, the Composer 2 launch illustrates the operational risks of incomplete disclosure. Cursor’s benchmark results, pricing strategy and training innovations formed a coherent product narrative, but the absence of explicit attribution created a gap that was quickly exposed through technical inspection.
