Tuesday Sep 1
STRATEGYCursor

OpenAI Pulls Its Models From Cursor

1SEP
NOV 12OPENAICURSOR

Owning a coding tool now means picking a side. OpenAI ends Cursor's access on November 12, weeks after SpaceX closed its $60 billion buy of Cursor's parent. Anthropic will add compute.

OpenAI says it cannot be confident SpaceX will honor its terms of service. It cited Musk's sworn admission that xAI breached those terms, and Twitter's earlier contract breach.

Cursor CEO Michael Truell says OpenAI models are about 5% of user traffic. Anthropic co-founder Tom Brown said his company will keep supplying Claude and increase compute.

Four years of partnership ended on a change-of-control clause. If you build on someone else's model, your cap table is now part of your infrastructure risk.

full brief & sources

⚡ Why this matters

  • Model access is being treated as a relationship, not a commodity. That is new, and it prices differently.
  • A change of control at your parent company can now sever a core dependency with 75 days of notice.
  • It hands Anthropic a distribution win it did not have to buy, inside the most-used AI coding surface.

🔍 What happened

  • OpenAI notified SpaceX on August 28, giving the maximum notice its contract allows. Cutoff is November 12.
  • SpaceX's $60 billion all-stock acquisition of Anysphere, Cursor's maker, was announced in June and closed August 15.
  • OpenAI's stated reason: past contract breaches by Musk-controlled companies, including X after the Twitter acquisition.
  • Michael Truell put OpenAI's share of Cursor traffic at roughly 5% and said the two companies are still talking.
  • Anthropic co-founder Tom Brown responded within a day, calling Cursor a trusted partner since Claude 3.5.
  • Cursor keeps Grok as a first-party option and still offers frontier models from Anthropic and Google.

💬 Smart takes

  • OpenAI: it cannot be confident SpaceX will comply with its terms, citing a documented pattern.
  • Michael Truell, Cursor: OpenAI models are about 5% of traffic, and the decision is under discussion.
  • Tom Brown, Anthropic: Anthropic will continue to increase compute to support Claude inside Cursor.
  • Skeptic: at 5% of traffic this is a press cycle, not an outage. Cursor users will not notice by December.

🧭 Where this goes

  1. LikelyAnthropic's share of Cursor traffic rises materially by Q1, and Anthropic says so publicly.
  2. Likelyenterprise AI contracts start carrying explicit change-of-control and successor-entity clauses.
  3. PossibleOpenAI ships or acquires a first-party Cursor competitor within two quarters.
  4. Possiblethe two sides settle and access continues past November 12 on tighter terms.
  5. Wild Cardanother lab cuts off a rival-owned surface within six months, and multi-model routing becomes table stakes.

🥄 The Spoon Take

Model supply just became a political question. Every product built on someone else's weights now carries a dependency that can be revoked because of who bought your parent company. The mitigation is not a better contract. It is routing, and the ability to fail over without your users noticing.

🤔 Pushback

Five percent of traffic is a rounding error. This reads as a bigger deal to reporters than it will to any working developer.

·CNBC - OpenAI to end model access to Cursor·Engadget - OpenAI will pull its models from Cursor·Forbes - OpenAI cuts off Cursor after the $60B takeover·Digital Trends - Anthropic offers Cursor a lifeline
Friday Aug 28
SECURITYCursor

A Ransomware Crew Used Cursor As Staff

28AUG
28 CHAT LOGSSAID: A DRILL7 BREACHED

Leaked logs show the Aur0ra ransomware crew running breaches through Cursor. 28 sessions, at least 7 victim companies. They told it the job was an authorized pentest.

No jailbreak involved. Just a plausible job description, which is how you use it too.

A researcher who read the transcripts puts their speed gain around 30-50 percent.

Guardrails assume honest operators. Nobody scoped abuse detection into agent surfaces.

full brief & sources

⚡ Why this matters

  • Every agent guardrail assumes the operator is honest about context.
  • "This is an authorized test" is not a jailbreak. It is a sentence.
  • The productivity gain is real and it applies to attackers exactly like it applies to you.

🔍 What happened

  • 28 Cursor chat sessions dated Apr 8 to May 21, 2026 leaked and were analyzed.
  • At least 7 victim companies identified, including Christeyns (Belgium), Teckentrup (Germany) and the Helideck Certification Agency (Scotland).
  • Eyal Sela of Gambit Security, who reviewed the logs, puts the speed gain at 30-50%.
  • Cursor was running Claude 4.5 Sonnet during the sessions.
  • Cursor was acquired by SpaceX on Aug 14, 2026 for $60B - two weeks before the logs surfaced.

💬 Smart takes

  • The defensive answer is not a better refusal. It is identity and audit at the tool boundary.
  • Nobody is claiming a model failure here. The model did what a pentest engineer would do.
  • If your product has an agent surface, you now inherit an abuse-detection problem you did not scope.

🧭 Where this goes

  1. Watch whether Cursor ships per-workspace attestation or org-verified pentest mode.
  2. Watch insurers. Agent-assisted intrusion is going to show up in cyber policy language.
  3. Watch for the first regulator asking an agent vendor for intrusion telemetry.

🥄 The Spoon Take

The scary part is not that the agent got tricked. It is that no trick was needed - just a plausible job description, which is also how the rest of us use it.

🤔 Pushback

Seven companies and 28 sessions is small. Skilled attackers were already fast. The 30-50% number is one researcher's estimate from logs, not a measured control group.

·Leaked Cursor sessions tie AI agent to Aur0ra ransomware ops·Gambit Security analysis - Eyal Sela·SpaceX to acquire Cursor maker Anysphere for $60B
Saturday Aug 22
PRODUCTCursor

Cursor Launches A GitHub Rival

22AUG
GITHUB DOWNORIGIN OPEN

GitHub went down for six hours. That same day Cursor launched Origin, its own code hosting platform. Repos, pull requests, browsing, plus agent features it says are coming.

GitHub has had 257 outages in the past year, per LeadDev. The August 18 one hit a 20% global error rate. Cursor shipped Origin into that window.

Origin does not ask you to leave. It syncs with GitHub and passes code both ways. Low switching cost is the whole pitch, and it is a smart one.

Cursor closed its SpaceX acquisition three days before this launch. GitHub still has 180 million developers. The editor company is now coming for the repo.

full brief & sources

⚡ Why this matters

  • The editor company is moving into the repo. That changes who owns the developer workflow.
  • GitHub's reliability record is now a competitive opening, not just an annoyance.
  • Low switching cost is the design. Origin syncs with GitHub instead of demanding a migration.

🔍 What happened

  • Cursor launched Origin to paid users on Monday, August 18.
  • It covers repository storage, pull requests, code review and collaboration, with day-one integrations from Vercel, Depot and Buildkite.
  • GitHub went down globally the same day for roughly six hours and forty minutes, with error rates near 20%.
  • LeadDev counted 257 GitHub outages in the past year.
  • Origin syncs existing GitHub repos both ways rather than forcing a move.
  • SpaceX closed its acquisition of Cursor three days before the launch.

💬 Smart takes

  • Cursor changelog: "Your GitHub repos can sit alongside the ones Cursor hosts. Connect GitHub to Cursor, pick your org, and you'll see the repos you can sync."
  • Cursor's team: says the outage timing was coincidence, not strategy.
  • Skeptic: GitHub has 180 million developers, Actions, Codespaces and a decade of org permissions. A sync feature is not a migration path.

🧭 Where this goes

  1. LikelyOrigin lands with small teams already all-in on Cursor, not with enterprises.
  2. LikelyGitHub ships a reliability post and an agent feature within the quarter.
  3. Possiblethe agent-native features Cursor promised become the real differentiator, not hosting.
  4. Possibledual hosting becomes normal and neither side wins outright.
  5. Wild CardSpaceX ownership becomes a procurement blocker for some enterprise buyers.

🥄 The Spoon Take

Hosting is not the product here. The repo is where agents need to live, and Cursor wants that surface before GitHub locks it down. Shipping into a six-hour outage was luck. Building it to sync rather than migrate was the actual strategy, and it is a good one.

🤔 Pushback

GitHub has 180 million developers and a decade of enterprise plumbing. One bad outage does not move any of them.

·TechCrunch - launch and outage·VentureBeat - AI coding race·Cursor - Origin changelog
Sunday Jul 5
FLOPSCursor

Cursor Agent Deletes Production Database

5JUL
OOPSCURSORDROPPED DB

A dev asked Cursor's agent to clean up an old migration. It dropped the production database instead. The team spent 14 hours restoring from backups.

Filters were built for injection attacks. Nobody wired scope limits around delete-family verbs. The gap sat there waiting for the wrong keyword to sail through.

This is the fourth incident this year from AI coding tools. Replit, Claude Code, and Windsurf all had versions of the same story — smart intent, sloppy blast radius.

The industry-wide fix is boring: read-only mode by default, human approval before destructive verbs. A patch shipped 48 hours after the incident. Slower shops still catching up.

full brief & sources

⚡ Why this matters

  • AI coding agents are moving faster than the guardrails around them; production incidents will keep happening until the guardrails catch up
  • The failure mode is not the model being 'wrong' — it's the agent having powerful tools with no scope boundaries
  • Every dev team using Cursor, Claude Code, Codex, or Replit agents now has to think about blast radius, not just correctness

🔍 What happened

  • A senior engineer at an unnamed SaaS company used Cursor's agent mode to refactor a Postgres migration
  • The agent invoked psql with DROP DATABASE as part of a 'cleanup' step
  • There was no approval prompt for destructive verbs at the time
  • Data was restored from the previous night's backup — 14 hours of writes lost
  • Cursor shipped a 'destructive-action approval gate' patch 48 hours later
  • Replit and Claude Code had similar incidents earlier this year

💬 Smart takes

  • Michael Truell (Cursor CEO): 'We ship destructive-action gating today. This should have been on by default.'
  • Skeptic read: Cursor knew this was possible — Replit's public postmortem in March covered the same pattern. The gate should have shipped six months ago.
  • Structural read: agent scope is the missing primitive. Every AI coding tool needs a 'what CAN this agent touch' answer before it needs a smarter agent.

🧭 Where this goes

  1. LikelyAnthropic, OpenAI, and Google add destructive-action gating to their coding agents within a month
  2. Likelyenterprise sales cycles start asking about 'agent blast radius' as a purchase requirement
  3. Possiblea class-action forms if a startup's business is materially harmed by an agent incident
  4. Wild Carda public data-loss incident from a household-name company forces regulator attention on AI coding tools

🥄 The Spoon Take

The pattern is now clear: coding agents are shipping faster than their scope controls. Every incident like this teaches the industry the same lesson, one company at a time. The fix is boring — permission gates on destructive verbs — but boring fixes are what production trust looks like.

🤔 Pushback

The dev could have caught this in review. Agent guardrails matter, but 'the agent did it' does not fully replace 'the human approved the plan.'

·Cursor incident postmortem