Five percent.

That is the number that turns this week’s news into a headline instead of an obituary. Cursor co-founder Michael Truell said OpenAI models carry about 5% of the tool’s traffic, which is why OpenAI ending the contract on November 12 costs Cursor a segment of users and not the company.

Three years ago that number would have been most of the product.

Nothing Cursor did caused this

On August 14, SpaceX closed a $60 billion acquisition of Cursor. Two weeks later OpenAI invoked a change-of-control clause and started the wind-down, citing a pattern of Musk-owned companies breaking agreements, including cutting off OpenAI’s Twitter data access in December 2022.

Thibault Sottiaux of OpenAI put it plainly: it boils down to trust.

No SLA was missed. No usage cap was blown. No term of service was violated by Cursor. A supplier made a judgment call about who it wants as a counterparty, and a clause somebody skimmed at signing turned that judgment into a 75-day countdown.

That is the part worth sitting with if you build on someone else’s models. Your exposure is not only technical performance and price. It is also who might buy you, who might buy your supplier, and how those two parties feel about each other.

The clause is boring until the day it is not

Change-of-control language sits in most commercial contracts. It gets read quickly because the scenario feels theoretical when you are trying to close a deal and ship.

Then a Friday arrives where it decides everything.

I would not tell you to renegotiate every agreement you have. That is not realistic and most counterparties will not move on it anyway. What is realistic is knowing what the clause says, how many days of notice you actually get, and what you would do with those days. Seventy-five days is enough time to migrate a well-separated system. It is not enough time to discover that your prompts, tool schemas and evaluations were written against one provider’s quirks.

We wrote about the mirror image of this when Meta added a clause letting it train its supplier’s replacement. Same risk, opposite side of the table.

This is the third time in fifteen months

June 2025: Anthropic cut off Windsurf. August 2025: Anthropic revoked OpenAI’s API access. August 2026: OpenAI cuts off Cursor.

The pattern repeats because the company selling you raw capability is frequently also selling the finished product you compete with. That structure does not require anyone to act in bad faith. It only requires a strategy change, or an acquirer the supplier dislikes.

Anyone building an application layer on frontier models is living inside that structure right now, whether or not it shows up in the risk register. We laid out how we grade this exposure in our note on picking AI vendors when trust is the real variable.

What I would check this week

Search your model contracts for the word “control” and read the whole paragraph. Write down the notice period on a sticky note.

Then measure the split for real. Calls per provider, in production, last week. Not the architecture diagram’s answer, the log’s answer. Most teams I talk to are off by a wide margin in one direction or the other, and the gap is always more interesting than the number.

Last, take one paid customer task and run it end to end against a second model. Two hours. You will learn more about your portability from that than from any vendor evaluation matrix.

At IQ Source the first artifact we produce when we map an AI operation is a dependency picture: who owns each step, and what happens to the step if that owner disappears. Not because we expect disappearance. Because the week it happens, the team holding that picture moves in days and the team without it argues for a quarter.

Cursor had the picture. That is the whole story.

Let’s map what breaks if one provider walks away