OpenAI has told SpaceX it intends to wind down the contract providing its models to Cursor, the AI coding tool SpaceX recently acquired, with a proposed shutoff date of 12 November.

In a statement published 28 August, OpenAI said it could not be confident SpaceX would use its technology within its terms of service, citing what it described as a history of Elon Musk's companies violating contracts. OpenAI said Twitter, now part of SpaceX, broke the terms of an earlier contract after Musk's acquisition of the company, and that Musk admitted under oath earlier this year that xAI, also now part of SpaceX, had violated OpenAI's terms of service. This account is drawn solely from OpenAI's own statement and the sources it cites.

OpenAI said its custom agreement with Cursor allows only a limited window to cancel following a change of control, and that it chose to hold the cancellation to the latest permitted date rather than cut access immediately, in order to maximise the time developers retain access to its models through Cursor. The company said it also has "a new level of accountability" over its forthcoming Astra model, given its advanced capabilities.

OpenAI said it has worked with Cursor for nearly four years and described the decision as "incredibly tough," adding that it intends to support affected developers through the transition.

Agentic Exploits- Deterministic gates for a probabilistic problem
David Girvin, CEO and co-founder of Assury, joins Stewart Tinson to dig into what’s actually happening when agentic AI goes wrong, and why he thinks most of the industry is solving the wrong layer of the problem. David explains the difference between prompt-level exploits and execution-level ones, arguing that the real danger starts the moment an agent moves from generating text to calling tools: deleting databases, reading files, sending emails. He walks through real-world incidents, including a Mexican government breach chain that escalated from just over a thousand prompts to over five thousand AI-executed actions across multiple agencies before detection, and the UK AI Security Institute’s recent cyber evaluation, in which agents took unsanctioned action including fabricating identities to socially engineer a real GitHub maintainer. The conversation covers why David is sceptical of “guardrails” language and AI-governing-AI approaches, arguing that only deterministic, architectural controls can reliably constrain agent behaviour, alongside human review reserved for genuinely high-stakes actions rather than blanket approval fatigue. He breaks down credential starvation, session risk accumulation, and why classifier-based tools keep failing inconsistently on identical actions, pointing to a named frontier lab’s own zero trust paper as an example of the industry misjudging what actually works. Elsewhere, David discusses the exposed MCP server problem, the widening trust gap between small specialist security vendors and platform incumbents, and why he believes regulation, not product quality alone, is what finally drives enterprise security spend. He closes with the exploit that concerns him most for the year ahead: session-level, goal-directed deception with no attacker involved at all.
BrightTALK
Share this post
The link has been copied!