P.K. SHARMA

Cyber security intelligence, AI governance, practitioner analysis

AI Security

OpenAI is cutting model supply to Cursor after SpaceX bought it. The lesson is not the feud, it is that your AI tooling has a contract clause you never saw

A change-of-control clause fired two weeks after the acquisition closed, and 12 November is now a date on a lot of developers tooling. The impact is narrower than the headlines: about 5%% of Cursor traffic by its own account, with bring-your-own-key access reportedly intact. And the sharpest line in OpenAI post, about an admission under oath, is a characterisation of testimony rather than a quote of it.

By Parminder Kumar Sharma · · 9 min read

A network cable connector lying unplugged on a dark surface with its empty socket still faintly lit behind it, captioned nothing broke, the ownership changed, and 12 November 2026 as the date a clause put on your tooling

What OpenAI announced

On 28 August 2026, OpenAI published a short post stating it had notified SpaceX that it intends to wind down the contract supplying OpenAI models to Cursor, with a proposed shutoff date of 12 November 2026. OpenAI says that is "the maximum notice provided by our contract."

The stated reason is trust: OpenAI writes that it "cannot be confident that SpaceX will use our technology within our terms of service, based on our experience with Elon Musk’s companies violating contracts." The mechanism is contractual: OpenAI says its agreement with Cursor "gives us a limited time window to cancel it after a change of control."

Two things are ending, on different clocks. Existing models stop on 12 November. Future models have already stopped: OpenAI says it is "not providing future models to Cursor, including its coming Astra model."

The part practitioners should take from this

Every AI supply-chain story this site has run has been technical: reseller hops nobody disclosed, shared backends, a cache that answers by timing. This one is contractual, and it is the layer with the least visibility of all.

The layer of your AI supply chain you cannot see

THE LAYER OF YOUR AI SUPPLY CHAIN YOU CANNOT SEENothing technical broke. The ownership changed, and a clause did the rest.THE CORPORATE LAYER, INVISIBLE TO THE DEVELOPERthe editor is acquireda change of controla clause you never reada limited window to cancela date on your toolingand no future models before itlands hereWHAT THE DEVELOPER ACTUALLY CHOSEyoupicked an editorthe editorcalls the model APIthe modelanswers your promptall of this keepsworking, until it does notYou never signed the contract that governs your dependency, and you cannot read the clause that ends it.
The structure is generic; the instance is OpenAI’s stated decision to wind down model supply to Cursor after its acquisition, exercising what OpenAI describes as a “limited time window to cancel” the agreement “after a change of control”. Every AI tool built on somebody else’s model has a contract of this shape underneath it, whether or not its users have ever considered one.
A developer chooses an editor. The editor holds a supply contract. The editor's owner changes, a clause fires, and a date appears on the tooling. Nothing technical broke.

Nobody using Cursor chose SpaceX. They chose an editor, and the ownership underneath it changed in a transaction they had no part in. A clause they have never read, in a contract they never signed, then put a date on their tools. There is no technical fault to debug and no configuration to fix.

What actually changes, and what does not

The headlines say OpenAI is cutting Cursor off. The detail is more precise, and more interesting, because the paths that survive are the ones that run through OpenAI’s own surface.

What ends on 12 November, and what does not

Path to an OpenAI modelStatus
OpenAI models bundled through CursorEnds on 12 November 2026
Future OpenAI models, including AstraAlready withdrawn, not provided at all
Using your own OpenAI API key inside CursorReported to continue working
OpenAI’s own IDE extensions running inside CursorReported to remain available
Anthropic, Google, Moonshot and Z.ai models in CursorUnaffected
Grok and Cursor’s ComposerUnaffected, and now listed as Cursor’s own models
Compiled from OpenAI's post and from statements by OpenAI's Codex lead Thibault Sottiaux on X. Cursor has published no migration guidance of its own.

That distinction matters. This is not "OpenAI models cannot be used in Cursor". It is the bundled commercial relationship ending, while the routes that keep OpenAI as the direct counterparty stay open. A developer who wants GPT in Cursor after November can reportedly still have it, by holding their own OpenAI account.

Cursor’s co-founder Michael Truell put a number on the impact, posting that "OpenAI models serve about 5% of Cursor user traffic" and that the company is "speaking with the OpenAI team to resolve this." He added that Cursor had "trusted their platform to be neutral infrastructure for our business."

If that 5% is right, this is less a catastrophe for Cursor than a signal about the model layer generally.

The corporate chain, which OpenAI compresses

OpenAI’s post says Twitter is "now part of SpaceX" and xAI is "now also part of SpaceX." Both are true, but they arrived by two separate transactions a year apart, and the sequence is worth having straight.

How a code editor ended up inside a rocket company

  1. Mar 2025

    xAI acquires X

    Announced 28 March 2025, an all-stock deal valuing X at $33bn and xAI at $80bn.

  2. Feb 2026

    SpaceX acquires xAI

    Announced 2 February 2026, bringing both xAI and X inside SpaceX, with orbital data centres given as the rationale.

  3. 12 Jun 2026

    SpaceX lists on Nasdaq

    The IPO gives SpaceX publicly traded stock, which becomes the currency for what follows four days later.

  4. 16 Jun 2026

    Cursor deal announced

    SpaceX agrees to acquire Anysphere, the company behind Cursor, in an all-stock merger.

  5. 14 Aug 2026

    The acquisition closes

    Per the SEC filing, at an implied equity value of $60.0bn, paid in about 389 million SpaceX Class A shares.

  6. 28 Aug 2026

    OpenAI gives notice

    Two weeks after closing, OpenAI exercises its change-of-control window and proposes a 12 November shutoff.

Acquisition dates from company announcements and, for the Cursor deal, from SpaceX's Form 8-K filed with the SEC on 14 August 2026. Deal structures for the xAI transaction are as reported rather than primary-verified.

Note what the acquisition already did to the model line-up. Cursor’s own documentation now lists Grok alongside its in-house Composer model, described as jointly trained by Cursor and SpaceXAI. The substitution for a departing OpenAI was staged before OpenAI departed.

Handle the "under oath" claim carefully

OpenAI supports its trust argument with two prior incidents. Both deserve precision, and one of them is being repeated in a form stronger than the record supports.

The Twitter claim needs the same care. The underlying reporting is that OpenAI paid Twitter a reported sum for data access, and that Musk cut that access off in December 2022 having judged the price too low. No court has found a breach. "Broke the terms of our contract" is OpenAI’s characterisation of a unilateral termination, and X has never publicly conceded or contested it.

None of this makes OpenAI wrong. A supplier is entitled to decide who it trusts, and it does not need a judgment to do so. But a company describing a counterparty’s conduct is an interested party, and "admitted under oath" reads as settled fact when the underlying admission was about something adjacent.

The commercial reading, stated plainly

OpenAI gives a compliance reason and does not mention the obvious commercial one. Both can be true, and the honest thing is to say so rather than pick.

OpenAI sells Codex, a competing coding product. Cursor is now owned by the company that also owns xAI, whose Grok models Cursor now ships as its own. So OpenAI is ending a bundled supply relationship with a rival coding tool owned by a rival model lab, and the paths it has left open are the ones where OpenAI remains the direct counterparty and keeps the customer relationship.

There is precedent in both directions, which argues against treating this as unprecedented. Anthropic cut Windsurf off from Claude in June 2025, and revoked OpenAI’s own API access in August 2025. Within hours of OpenAI’s announcement, Anthropic co-founder Tom Brown said Anthropic would "continue to increase compute to support Claude models in Cursor." The suppliers are all playing the same game.

Musk’s response, reported by Reuters, was "I couldn’t care less." SpaceX has issued no statement, and Cursor has published no migration guidance.

What to do

Take this with you

For teams whose tooling depends on somebody else’s model

  • Write down which of your tools resell a model you do not contract for directly. That is your exposure list. If the answer is a bundled subscription rather than your own API key, a change of ownership at either end can move your access without your involvement.
  • Prefer holding your own model credentials where the tool supports it. In this case the reported survival of bring-your-own-key access is exactly the difference between a tool decision and a supplier decision, and it is the cheapest form of insurance available.
  • Treat vendor ownership as a monitored risk, not background news. Change-of-control clauses are standard and invisible to end users, so the trigger for losing a dependency can be an acquisition you read about in the press.
  • Keep a tested second model path in any workflow that matters. Cursor users still have Anthropic, Google and others, which is why this is disruptive rather than fatal. A workflow pinned to one provider through one reseller has no such cushion.
  • Do not assume regulation covers this. Analysis of the EU Data Act switching rules makes the point neatly: they protect a customer who chooses to leave a provider, not a customer whose provider decides to leave them.

The position

The interesting thing here is not the feud. It is that a large number of developers have just discovered they had a dependency with a termination clause in it, and that neither end of that clause was theirs.

This site keeps writing about the AI supply chain as a technical problem, because that is where the measurable failures have been. This is the same argument one level up. The question "who serves my prompt" has a corporate answer as well as a technical one, and the corporate answer can change in a single transaction. Nobody using Cursor in June chose to depend on the outcome of a merger, and by August that is what their tooling depended on.

Two closing cautions, both about precision, which is the only thing this story is short of. The impact is smaller than the headlines imply: around 5% of traffic by Cursor’s own account, with the bring-your-own-key path reportedly intact. And the sharpest sentence in OpenAI’s post, the one about an admission under oath, is a characterisation of testimony rather than a quotation of it. When a dispute is this public, the details are exactly what gets flattened, and the flattened version is what everyone remembers.

Sources

  1. PrimaryOur decision on Cursor following its acquisition by SpaceX, 28 August 2026OpenAIaccessed 2026-08-29
  2. PrimarySpace Exploration Technologies Corp. Form 8-K, completion of the Anysphere merger, 14 August 2026US Securities and Exchange Commissionaccessed 2026-08-29
  3. PrimaryCursor is now a part of SpaceX, 14 August 2026Cursor (Anysphere)accessed 2026-08-29
  4. Reported byElon Musk testifies that xAI trained Grok on OpenAI models, 30 April 2026TechCrunchaccessed 2026-08-29

Share this briefing

Know someone who owns this problem? Send it to them.

Related briefings

The briefing, in your inbox

Practitioner analysis of cyber and AI security news. No vendor noise.

One email per briefing. Unsubscribe any time.