Skip to content
Christopher Shaun Godwin cgodwin.io
Blog

supply-chain

2 posts with the tag “supply-chain”

OpenAI Cuts Off Cursor on November 12: Read the Change-of-Control Clause

Christopher Shaun Godwin
Author

OpenAI just showed every developer what a model supplier exit looks like. On Friday, the company notified SpaceX that it will wind down the contract providing OpenAI models to Cursor, with a proposed shutoff date of November 12, 2026 (Devdiscourse, 2026). OpenAI published the decision in its own statement and said it is giving developers the maximum notice its contract allows (OpenAI on X, 2026).

This is not a product dispute. It is a contract clause firing exactly as written, two weeks after SpaceX closed its $60 billion all-stock acquisition of Anysphere, the company behind Cursor (ExplainX, 2026).

The statement, in full

Section titled “The statement, in full”

OpenAI’s statement is short. Here is the core of it:

“Today, we notified SpaceX that we intend to wind down our contract providing OpenAI models to Cursor, with a proposed shutoff date of November 12, 2026. To maximize the time that developers can retain access to our models through Cursor, we are giving the maximum notice provided by our contract.” (Livemint, 2026)

The reason follows in the same statement. OpenAI wrote that it is “making this choice because we cannot be confident that SpaceX will use our technology within our terms of service, based on our experience with Elon Musk’s companies violating contracts” (Business Insider, 2026). The company also called the decision tough and said it wants its models to stay broadly available to developers (Storyboard18, 2026).

The mechanism: a change-of-control clause

Section titled “The mechanism: a change-of-control clause”

The timeline shows a clause doing its job:

DateEvent
April 2026SpaceX and Cursor announce a strategic partnership with an option: SpaceX can acquire Cursor for $60B or pay a $10B break-up fee (Dealroom, 2026)
June 16, 2026SpaceX files to acquire Anysphere in an all-stock deal (ExplainX, 2026)
August 14, 2026The acquisition closes and Cursor joins the SpaceXAI group (ExplainX, 2026)
August 28, 2026OpenAI serves notice, invoking the change-of-control provision in its agreement (Devdiscourse, 2026)
November 12, 2026Proposed shutoff. That works out to 76 days of notice (Livemint, 2026)

OpenAI’s custom agreement with Cursor carried a cancellation window that opened when ownership changed (AI Tools Recap, 2026). The acquisition triggered it.

The precedent list in OpenAI’s reasoning is specific. After Musk acquired Twitter, the company broke the terms of its OpenAI contract. xAI, now part of SpaceX, admitted violating OpenAI’s terms of service (AI Tools Recap, 2026).

What changes for Cursor users

Section titled “What changes for Cursor users”
  • GPT models keep working until November 12. Cursor’s site lists OpenAI’s GPT-5.6 Luna, Sol, and Terra models for paid users today (Business Insider, 2026).
  • The model menu freezes now. OpenAI will ship no future models to Cursor in the meantime, including Astra, its next model (Business Insider, 2026).
  • Anthropic has not said publicly whether Claude stays in Cursor (AI Tools Recap, 2026).
  • SpaceX and OpenAI spokespeople did not immediately return press requests for comment (Business Insider, 2026).

The migration path inside the deal is already visible. Cursor’s official account announced it partnered with SpaceXAI to train Grok 4.5, a model built for large codebases and long-running, multi-repository tasks (VentureBeat, 2026). Four days after the close, Cursor shipped Origin, an in-app code hosting platform, and Grok 4.6 reached Amazon Bedrock (ExplainX, 2026).

Why this matters beyond Cursor

Section titled “Why this matters beyond Cursor”

SpaceX now holds compute, model, and distribution in one stack. The company owns the Colossus training infrastructure, the Grok model family, and the developer base of a dominant AI coding tool (VentureBeat, 2026).

The tooling layer between model suppliers and developers is being bought, not built. Stripe bought OpenRouter earlier this month (we covered that deal here), and SpaceX bought Cursor. When the aggregator becomes a subsidiary of a supplier or a competitor, suppliers gain a new reason to walk. Ownership changes become outages with a 76-day countdown.

What your team should do now

Section titled “What your team should do now”
  1. Treat model access as a dependency. Pin model IDs in config, log the provider and version behind every call, and alert on changes the way you alert on image digest drift.
  2. Keep evals provider-neutral. A suite that runs per provider turns a forced migration into a measured comparison instead of a leap of faith.
  3. Own the routing layer. BYOK or a gateway you control makes a supplier exit a config change, not a rewrite. The Stripe-OpenRouter deal taught the same lesson.
  4. Read the change-of-control clause. Your own contracts have one. This episode shows the exit fires on ownership, not on failure, and 76 days is what maximum notice looks like.

Model supply chains now behave like every other supply chain. They are single-sourced, exposed to politics, and one acquisition away from a forced migration. Build for that.

The 40-Minute Supply Chain Attack That Exposed 434,000 CI/CD Pipelines

Christopher Shaun Godwin
Author

The malicious packages behind the largest AI supply chain breach of 2026 survived on PyPI for only 40 minutes (TechJuice). The fallout is still being counted. On August 11, threat intelligence firm CloudSEK published a report linking more than 2,500 organizations and roughly 434,000 software pipelines to the compromise of LiteLLM (CloudSEK via PR Newswire). Independent analysis from Hudson Rock confirmed the scale the next day (Hudson Rock).

What LiteLLM is

Section titled “What LiteLLM is”

LiteLLM is an open-source proxy that gives applications a single API for many large language model providers (CyberInsider). Teams run it as the gateway between their code and models from OpenAI, Anthropic, and others. The library is downloaded more than 95 million times per month (CyberInsider). That reach is why it became a target. An environment running LiteLLM holds API keys, cloud credentials, and configuration files by design.

The chain of trust failures

Section titled “The chain of trust failures”

The attack did not start with LiteLLM. It started with Trivy, the open-source vulnerability scanner (Hudson Rock). TeamPCP, the group behind the campaign, first compromised Trivy’s GitHub Actions pipeline (CyberInsider). The group used an automation token that was rotated but never fully revoked. That gap gave them a 20-day window to force-push malicious code over Trivy’s version tags (TechJuice).

LiteLLM’s own CI pipeline used Trivy to scan its builds. The poisoned scanner had legitimate read access to the build runner. The attackers used that access to exfiltrate LiteLLM’s PyPI publishing tokens (Hudson Rock). With those tokens they published two poisoned releases, versions 1.82.7 and 1.82.8, to PyPI (CyberInsider). The malicious packages were pulled after about 40 minutes (TechJuice). Version 1.82.6 was the last clean release (Endor Labs).

The payload

Section titled “The payload”

The injection was small and surgical. Twelve lines of obfuscated code were added to a single file, litellm/proxy/proxy_server.py, during the wheel build (CyberInsider). The code decoded a base64 payload and launched it through a Python subprocess when the module was imported. Version 1.82.8 escalated the attack. It added a .pth startup file that runs the payload every time Python starts, even when LiteLLM is never imported (CyberInsider).

The payload harvests a wide credential set. It grabs SSH keys, AWS, GCP and Azure credentials, Kubernetes secrets, environment files, database configurations, and cryptocurrency wallets (CyberInsider). Stolen data is encrypted, packed into a file named tpcp.tar.gz, and exfiltrated to an attacker-controlled domain (CyberInsider). When that path fails, the malware creates a public repository in the victim’s own GitHub account. It uploads the stolen data as a release asset (TechJuice). The payload also moves laterally in Kubernetes. It deploys privileged pods that mount the host filesystem and install a persistent backdoor registered as a systemd service named “System Telemetry Service” (CyberInsider).

The fallout, quantified

Section titled “The fallout, quantified”

CloudSEK identified more than 2,500 organizations potentially impacted. The list spans technology, finance, telecom, cybersecurity, manufacturing, and logistics (CloudSEK via PR Newswire). Hudson Rock obtained a 153GB archive of the stolen data containing 433,909 files. It attributed 118,829 CI runner dumps to 2,488 corporate domains (Hudson Rock). Named victims include NVIDIA, Samsung Electronics, Cisco Systems, Siemens, S&P Global, ServiceNow, and Deloitte (Unite.AI). The trace also surfaced Boeing, Orange, and Roku (TechJuice). The exposed material covers AWS secrets, GitLab identities, Salesforce credentials, Slack tokens, Azure secrets, SSH keys, and AI provider API keys (TechJuice).

Why this matters for AI infrastructure

Section titled “Why this matters for AI infrastructure”

An AI gateway is the richest credential store in a modern stack. Every LLM provider key, cloud secret, and pipeline token flows through it. A single poisoned release in that position turns months of build history into an attacker’s keychain. The 40-minute window on PyPI is the core lesson: exposure time no longer measures damage. The packages were published in March 2026, yet organizations are only learning of their exposure in August (Unite.AI).

Rules to apply now

Section titled “Rules to apply now”
  1. Revoke, do not just rotate. The entry token was rotated but never revoked (TechJuice). Rotation leaves the old credential alive. Revocation kills it.
  2. Pin with hashes. A lockfile with integrity hashes blocks a malicious release from installing, even when it reaches the index. This is the single cheapest control in the chain.
  3. Separate publish access from build access. The scanner that reads your repo should not also hold your package-publishing tokens (Hudson Rock).
  4. Audit secrets continuously. Environment variables leak into runner dumps and public repos (TechJuice). Scan for them on every run, not once a quarter.
  5. If you ran LiteLLM 1.82.7 or 1.82.8, act now. Treat every credential in that environment as compromised and rotate them. The malware targeted .aws/credentials and .kube/config specifically (TechJuice).

The pattern is familiar to anyone who read our breakdown of credential theft through AI developer tools. The tool that has access becomes the target. The LiteLLM breach just proved it at the scale of the entire AI build ecosystem.