Cursor Hid Its AI Model — Here's How to Take Back Control with Direct API Access

Cursor Hid Its AI Model — Here's How to Take Back Control with Direct API Access TL;DR : Cursor shipped Composer 2 built on Kimi K2.5 (a Chinese open-source model) without disclosing it. A developer found the model ID in API traffic within 24 hours. Here's why this matters — and how to stop trusting black-box tools. What Happened with Cursor? On March 19, 2026, Cursor announced Composer 2 — billing it as their own proprietary AI model for coding. The benchmarks looked impressive: 61.7 on Terminal-Bench 2.0, beating Claude Opus 4.6. Pricing at $0.50/M tokens. A clear "we built this" narrative. It lasted less than 24 hours. Developer @fynnso was testing Cursor's OpenAI-compatible base URL when an unexpected string appeared in the API response: accounts/anysphere/models/kimi-k2p5-rl-0317-s515-fast That wasn't a Cursor internal name. It decoded cleanly: kimi-k2p5 = Kimi K2.5, an open-weight model from Beijing-based Moonshot AI. rl = reinforcement learning fine-tuning. 0317 = March 17 train