Prompts typed into Cursor do not travel from your editor to OpenAI. They pass through Cursor’s own deployment first, an intermediate hop between your machine and the model lab that an OpenAI data processing agreement, by itself, does not cover. On August 28, 2026, OpenAI announced it intends to wind down the contract supplying its models to Cursor, with a proposed shutoff of November 12, 2026 and no future OpenAI models promised. Every element of that announcement is OpenAI’s account of a contractual dispute; no Cursor or SpaceX response appeared in the material available today, so treat each claim as vendor-reported until one does.
What did OpenAI actually announce?
OpenAI said it has notified SpaceX that it intends to wind down the contract providing OpenAI models to Cursor, with a proposed shutoff date of November 12, 2026, and that no future OpenAI models will reach the editor. The statement, titled “Our decision on Cursor following its acquisition by SpaceX”, frames the split as counterparty-driven rather than capability-driven: OpenAI says it has worked with Cursor for nearly four years and expresses respect for the team and the product. The problem, per OpenAI, is the new owner.
The reasoning OpenAI gives is that it cannot be confident SpaceX will use its technology within OpenAI’s terms of service, citing what it describes as its experience with Elon Musk’s companies violating contracts. OpenAI further states that, under oath earlier in 2026, Musk admitted that xAI, now also part of SpaceX, had violated OpenAI’s terms of service. Both of those are OpenAI’s assertions about a counterparty, not court findings in any material reviewed here, and they should be quoted that way. The announcement also names exactly one forward-looking model: Astra, which OpenAI says carries “a new level of accountability” to ensure use in accordance with its terms. Whatever Astra turns out to be, Cursor users will not see it inside Cursor under this decision.
What the statement does not say matters as much as what it does. It refers to “OpenAI models” generically and names no specific current model version, so any claim that a particular flagship model’s mechanics are implicated goes beyond the source. It describes the shutoff date as “proposed,” which means the date can move, be negotiated, or be litigated. And it says nothing about prompt routing, data retention, or telemetry inside Cursor, because that was never its subject.
Meanwhile, Cursor’s own site, observed August 31, still presents business as usual, advertising a model menu spanning OpenAI, Anthropic, Gemini, SpaceXAI, and Cursor’s own first-party models. The two vendors’ public framings do not reconcile. One side says the supply is being severed; the other side’s storefront still lists the supplier. Teams waiting for a clean joint statement before acting may be waiting past the deadline.
Where do Cursor prompts actually go when you pick an OpenAI model?
Nobody outside Cursor and its model suppliers can answer that precisely from public material, and that gap is the finding. What can be stated structurally is that Cursor is an editor-vendor product: the IDE collects your prompt along with whatever repository context the feature requires, and everything from there to whichever lab serves the model you selected is the hop this review has to interrogate rather than assume. The relay through editor-vendor infrastructure is the implied shape of an editor-routed product, not an observed fact; no source reviewed for this piece describes Cursor’s actual routing internals, retention windows, or telemetry handling, so everything below about that hop is framed as what your review must establish, not as observed behavior the sources confirm.
The contrast with the two other common shapes is what makes the risk concrete:
| Question your review must answer | Direct API call to the lab | Editor-routed (Cursor) | First-party tool (Claude Code with Anthropic) |
|---|---|---|---|
| Whose infrastructure does your prompt land on first? | The lab’s | The editor vendor’s, then the lab’s | The lab’s (tool vendor and lab are the same company) |
| How many contracts govern the full path? | One: yours with the lab | Two or more: yours with the editor, plus the editor’s supply contract with the lab, which you have never seen | One |
| Which corporate events can cut off your model supply? | Your own dispute with the lab | Any dispute between the editor vendor and the lab, independent of your own agreements | Your own dispute with the lab |
| What does your existing lab DPA cover? | The full path | The final hop at most; the intermediate hop sits outside it | The full path |
| Who must you audit when the path changes? | The lab | The editor vendor, for a path it may not fully document | The lab |
The first and third columns describe paths where the counterparty you contracted with is the counterparty that can break you. The middle column is the one most security reviews get wrong. A review that concludes “we send data to OpenAI, and we have an OpenAI DPA” has audited the final hop and called it the path. The editor vendor in the middle decides what context leaves your machine, where it is processed before forwarding, how long it is retained, and which lab receives it, and none of those decisions are governed by your agreement with the lab.
This is the part your OpenAI DPA does not cover.
The November 12 notice makes the abstraction visible, but the abstraction was always there. When a team standardizes on Cursor with an OpenAI model selected, it has made two delegations while typically reviewing one: a delegation of its data path to the editor vendor, and a delegation of its model supply to a contract between two companies it does not do business with directly. The second delegation just failed in public.
What does Cursor’s model menu look like after November 12?
Per Cursor’s own site, the menu spans frontier models from OpenAI, Anthropic, Gemini, SpaceXAI, and Cursor itself; after the proposed shutoff, the OpenAI entries are the ones that go away, current OpenAI models freeze at their present versions, and no newer ones arrive. The presence of a “SpaceXAI” provider label on Cursor’s own storefront is itself notable: it corroborates the SpaceX and xAI consolidation that OpenAI’s statement references, and it means the editor’s post-shutoff menu will likely feature models from the very counterparty OpenAI says it cannot trust with its terms of service.
For teams, the menu question is really a fallback question, and it has a deadline attached. The practical options, per Cursor’s own listing, are Anthropic models, Google’s Gemini models, SpaceXAI models, or Cursor’s first-party models. Choosing among them is not a benchmark exercise so much as a governance exercise: which lab’s terms, retention posture, and corporate structure can your security team actually review and accept before November 12? A team that picks its fallback on vibe and eval scores has repeated the original mistake of treating the editor abstraction as the whole decision.
Two open questions no reviewed source answers, and both belong in your audit: whether Cursor will silently remap default model selections to a non-OpenAI provider as the date approaches, and what happens to in-flight features that assumed an OpenAI model behind them. Editor vendors routinely adjust defaults. If your team’s model selection is “whatever Cursor defaults to,” you do not currently know what model your prompts will reach in December, and neither does your DPA.
How did an acquisition sever a model supply you never contracted for?
The mechanism is counterparty risk one level removed: the contract that determines whether your editor has OpenAI models is a contract between OpenAI and Cursor’s owner, and an ownership change on either side can void assumptions your own agreements never contained. Your team changed nothing, signed nothing, and breached nothing. The supply still ends, because the supply was never yours to begin with. It was a term in someone else’s contract, and that someone else got acquired.
OpenAI’s statement is explicit that this is about the acquirer, not the product. Four years of cooperation, respect for the Cursor team, and a commitment to hold the cancellation to the latest date it can, per the announcement, while still refusing to ship future models into the relationship. Read uncharitably, that is a lab turning a distribution channel into pressure on a rival’s owner. Read charitably, it is a lab enforcing terms-of-service exposure it genuinely believes in. Either reading produces the same operational fact for your team: a corporate event you had no part in restructured your toolchain.
The concentration dimension deserves its own look. Cursor’s site carries a testimonial from NVIDIA President and CEO Jensen Huang that roughly 40,000 NVIDIA engineers1 now work with AI assistance using Cursor. That figure is vendor-published and unaudited, but even taken as approximate it describes a single-editor, single-routing decision sitting underneath one of the largest engineering organizations in the industry. Concentration of that kind is efficient right up until the day the abstraction leaks, and then it is a migration program measured in tens of thousands of seats.
OpenAI’s own position is worth noting for calibration. According to Wikipedia’s record, OpenAI closed an April 2026 funding round at a post-money valuation of $852 billion2 and filed for an initial public offering in June 2026. Both are medium-confidence, community-maintained data points, but they frame the decision economics: a company at that valuation can afford to walk away from a distribution channel over a terms-of-service principle, and a company entering public-company reporting will have future supply disputes of this kind surface in filings and disclosures whether it wants the visibility or not. Buyers get more warning signals in that regime. They still have to read them.
What must a governance review of the intermediate hop cover?
It must establish, in writing and from the editor vendor rather than the lab, everything your model-lab DPA does not reach: where prompts and repository context are processed, how long they are retained, what telemetry leaves the IDE, which sub-processors touch the data, and what happens to in-flight data when a supplier contract ends. If your current review artifact is a DPA with a model lab plus a procurement note saying “the team uses Cursor,” the review has not covered the path; it has covered the endpoints and assumed the middle.
A workable checklist for the intermediate hop, in the order most teams will need it:
- Data path mapping. Which features send what context where. Tab completion, chat, and agent modes typically ship different slices of your repository through different routes, and “Cursor sends code to a model” is not a map. Get the vendor’s per-feature description, not the marketing page’s.
- Retention and training-use terms at the editor layer. Separate from the lab’s terms. The lab promising not to train on API traffic says nothing about what the editor vendor retains or uses.
- Telemetry inventory and opt-outs. What usage data leaves the IDE independent of prompt content, and which of it is contractually suppressible.
- Sub-processor and region disclosure. Which third parties and jurisdictions the editor vendor’s own infrastructure touches before the lab hop.
- Default-model and remapping behavior. What the vendor does to model selections when a provider exits the menu, and whether that behavior is contractual or discretionary.
- Supplier-exit handling. What the vendor commits to when a model supply contract ends: notice periods, data handling for in-flight sessions, and migration tooling.
The VS Code lineage cuts both ways and is worth one paragraph of honesty. An editor built on VS Code inherits a familiar interface and extension habits, which lowers the cost of switching into it. Nothing about that inheritance lowers the cost of switching out of its model routing, because the routing is the vendor’s layer, not Microsoft’s. Teams that chose Cursor partly because “it is basically VS Code” should not assume the exit is equally shallow: the editor is portable, but the reviewed data path, the muscle memory around specific model behaviors, and any workflow built on a particular provider’s models are not.
What should teams do before November 12?
Treat November 12, 2026 as a hard review deadline even though it is only a proposed one: audit the editor-to-model hop now, name a non-OpenAI fallback in writing, and stop letting “we send data to OpenAI, and that is reviewed” stand in for a data-path assessment. The fallback menu, per Cursor’s own listing, is Anthropic, Gemini, SpaceXAI, or Cursor’s first-party models; pick one on governance criteria, run a real workload through it before the deadline, and document the data path for the new route the way you should have documented the old one.
Now the caveats, because they are load-bearing. Every claim about the shutoff comes from one side of a contractual dispute, OpenAI’s own statement, with no Cursor or SpaceX response, contract text, or DPA in the reviewed material. The date is explicitly proposed and could move, be renegotiated, or end up in litigation; the under-oath and terms-of-service claims are OpenAI’s characterizations, not findings. And nothing in the sources describes Cursor’s actual routing, retention, or telemetry internals, which is why the data-path sections above are written as audit requirements rather than observed behavior. If Cursor or SpaceX publishes a rebuttal tomorrow, the news half of this piece gets revised. The audit half does not.
That asymmetry is the durable lesson. The wind-down notice will leave the feed within weeks, the date may slip, and the two companies may settle. The structural exposure remains regardless: when your team’s prompts and your model supply both ride on an editor vendor’s deployment, they ride on contracts you have never seen, between companies whose corporate events, acquisitions, feuds, IPO disclosures, are not coordinated with your renewal cycle. A governance review that ends at the lab’s DPA is reviewing the wrong boundary. Audit the hop, name the fallback, and write down who owns the answer when the next supply contract between two other companies ends.
Frequently Asked Questions
Does the November 12 shutoff affect teams using Cursor’s first-party models?
No, the wind-down specifically targets the contract supplying OpenAI models. Cursor’s first-party models, along with Anthropic, Gemini, and SpaceXAI options, remain available on the menu. However, teams relying on OpenAI-specific features or fine-tuned behaviors must migrate those workloads to the remaining providers before the date, as no future OpenAI models will be integrated.
How does the OpenAI-Cursor split differ from a standard API deprecation?
Unlike a direct API deprecation where the user receives notice from the lab, this split is driven by a counterparty dispute between OpenAI and Cursor’s new owner, SpaceX. Users did not breach any terms; the supply cut is a result of OpenAI’s inability to trust SpaceX’s adherence to its terms of service, a risk invisible in direct lab contracts.
What specific governance gap does the ‘intermediate hop’ create for security teams?
The intermediate hop means the editor vendor controls data retention and telemetry independently of the model lab’s Data Processing Agreement. A standard OpenAI DPA only covers the final hop to the lab, leaving the editor’s infrastructure, sub-processors, and retention policies uncontracted and unaudited by the user’s security team.
Why is the ‘SpaceXAI’ label on Cursor’s menu a red flag for governance?
The presence of SpaceXAI models on Cursor’s menu corroborates the consolidation of xAI into SpaceX, the very entity OpenAI cites as a reason for the split. This creates a conflict where the editor offers models from the counterparty OpenAI claims cannot be trusted with its terms, complicating any future reconciliation or trust-based routing decisions.
What operational risk arises if Cursor silently remaps default models before the shutoff?
If Cursor remaps defaults to a non-OpenAI provider without notice, teams lose visibility into which model is processing their code. This breaks the assumption that a specific model version is being used, potentially violating internal compliance policies that require explicit model selection and documented data paths for sensitive repositories.
