On November 12

Top Story

On November 12, 2026, the most widely used AI coding tool loses its most widely used models. OpenAI told SpaceX on Thursday that it is winding down its contract supplying models to Cursor, exercising a cancellation clause that the change of control triggered. It picked the latest legally available shutoff date, and it is clear it will not be the last cutoff: OpenAI also said it will not provide its upcoming Astra model to Cursor at all, regardless of the November date.

The stated reason is a pattern, not a single event. OpenAI’s post cites two prior violations by companies Elon Musk controls: the breach of contract after Musk acquired Twitter — now part of SpaceX — and xAI’s acknowledged distillation of OpenAI data to train its own models, which Musk admitted under oath earlier this year. OpenAI says a custom agreement with Cursor left it only a limited window to cancel after the change of control, and that as capabilities advance with Astra it needs a stronger guarantee the models are used inside its terms. “We cannot be confident that SpaceX will use our technology within our terms of service,” the company wrote, “based on our experience with Elon Musk’s companies violating contracts.”

That is an extraordinary sentence for a vendor to publish about its own customer, and it lands where the developer community is most exposed. Cursor has spent four years building a product whose default reasoning is OpenAI. An entire class of working engineers has come to assume that “open Cursor” and “GPT-class model behind it” are the same motion. On November 12 that assumption stops being true for every Cursor subscriber at once, not gradually. There is no staged migration window; there is a hard date.

The practical questions are immediate and unglamorous. What happens to developers’ existing projects and the tooling built around them on the November cutoff? Cursor’s own model lineup, and the smaller OpenAI models that sit beneath its agentic features, are inside the contract too. Whether Cursor has already lined up replacement reasoning capacity at the scale OpenAI was supplying — and who that capacity is — is not disclosed anywhere in either company’s statement. That is the gap the market will now try to price in within hours, not weeks.

The bigger thing this changes is what it says about model ownership as a leverage point. The AI market has spent two years assuming the scarce asset is compute, or data, or talent. OpenAI’s move names a fourth one: the right to cut a customer off. A change-of-control clause in a model-supply contract has now been used to turn a close four-year partner into a competitor-in-waiting on a fixed date, and the terminating party has published the reasoning in a blog post. Every lab that sells its models into tools it does not control just saw the ceiling on that arrangement redrawn. The open-weight releases from three labs elsewhere in today’s edition are not unrelated news; they are the obvious hedge, and their timing — GLM, Tencent’s Hunyuan, and a third arriving in the same week — starts to look like supply rearranging itself around this kind of ownership risk.

What this story actually earns as a closing fact: the decision does not hinge on what any court or regulator does next. It hinges on what Cursor does in the next eleven weeks. Cursor has not yet said what it will run on November 12 — the statement carries only OpenAI’s announcement. Whether Cursor already holds a competing frontier model to hand, or has to negotiate one under time pressure against a seller who knows the deadline, will determine whether the tens of thousands of developers relying on it see a seamless swap or a scramble. OpenAI’s notice was the maximum its contract allowed, and it still leaves Cursor a fixed calendar to replace the model at the center of its product. The clock is now the story. Our decision on Cursor following its acquisition by SpaceX

Also Today

GLM-5.3 is now open-weight · Source Z.ai released GLM-5.3 as open weights on the same base as GLM-5.2, so every gain comes from post-training. It claims a 50% jump over 5.2 on its own coding bench and open-source SOTA on Terminal Bench 3.0 and Agents’ Last Exam, but the headline is the cyber curve: state of the art on CyberGym, more than doubling 5.2 on exploitation benchmarks, which the team says scaled “faster than we expected.” The numbers carry caveats — most runs use a Claude Code harness, throughput-rescaled and judged by a GPT-5.6 model. But the benchmark mechanics matter less than that an agent this capable at vulnerability discovery now ships as freely reproducible weights, serviceable locally in SGLang or vLLM. Offensive capability is no longer gated behind a vendor.

Tencent Hunyuan Hy4 preview is open-source, join “train yourself”! WorkBuddy hands-on: it has small-team delivery capability, but someone still has to watch it · Source Tencent open-sourced Hy4 preview — 770B total, 49B active, 1M context — aimed at agent, coding and productivity work, and claims it as the first Hunyuan model to help optimize its own training, running experiments and feeding results back into a recursive self-improvement loop. InfoQ’s WorkBuddy testing found real “small-team delivery” ability, including a working four-endpoint product build, but the last mile fails: a procurement report got Cursor’s annual prices wrong, and promised tests wouldn’t run off the author’s machine. Human sign-off is still required. All of this lands against Tencent’s admitted compute shortage — Q2 capex up 176% year over year, free cash flow negative. Tencent is betting its scenario depth, not model supremacy, is the moat.

EPA says power for data centers can sidestep pollution laws · Source The EPA issued guidance saying the Clean Air Act’s Acid Rain Program does not apply to “islanded” power generation — facilities not connected to a public grid — clearing a regulatory lane for data center operators to run their own grid-free plants with looser pollution accounting. The reasoning: such plants neither sell electricity nor report to the DOE as generating units, so the ARP does not reach them; connect to the grid later and it may. Combined with the Ratepayer Protection Pledge’s self-powering push, the message to builders is that off-grid compute is now the cheaper, less-regulated path. Whatever the emissions merits, the incentive structure just tilted further toward keeping data centers off the public grid.

Anthropic was illegally blacklisted by the Trump administration, court rules · Source A federal judge ruled the Pentagon’s blacklisting of Anthropic unconstitutional — “unlawful retaliation in violation of the First Amendment,” with the supply-chain-risk designation called “arbitrary and capricious.” Judge Rita Lin’s line — “The empty invocation of national security is not a blank check to punish and retaliate against government critics” — captures the fight. Anthropic refused the military’s expanded “any lawful use” terms and held red lines on mass surveillance and lethal autonomous weapons; the Pentagon responded by signing seven other labs, including SpaceX, into its roster. The ruling restores Anthropic as a potential DoD vendor, but the deeper question — what a lab may decline — now sits with Congress and politics rather than the courts.

Court rules Kalshi sports bets aren’t “swaps,” just gambling with a different name · Source A unanimous 9th Circuit panel ruled Kalshi’s sports event contracts are not “swaps” — they are gambling, and Nevada can regulate them. Quoting Romeo and Juliet, Judge Ryan Nelson wrote that “placing sports bets, even when called by another name, is still gambling.” The decision directly conflicts with the 3rd Circuit’s opposite finding, setting up the Supreme Court to decide whether CFTC jurisdiction preempts state gaming law. The panel also noted existing CFTC rules already bar gaming contracts, even as a Trump-era CFTC proposal would allow them, and remanded Kalshi’s election contracts. The circuit split, more than any reading of the CEA, will now decide how fast prediction markets scale.

In Brief

• htmx 4.0.0 is out after eight months of work, shipped alongside a companion browser game. (Source)
• Pydantic’s httpx2, a next-generation HTTP client for Python, is now available. (Source)
• Alibaba open-sourced Qwen3.8-Flash, a 125B-parameter multimodal MoE with a 51B N-gram embedding, promising up to 75% lower token consumption in office-agent workloads. (Source)
• Meta’s LeVJEPA matches V-JEPA 2 at up to 20× less pretraining compute using a single-objective SIGReg recipe with no EMA, stop-gradient, or masked prediction. (Source)
• Luanti’s Android app was pulled from Google Play after a baseless AI-generated DMCA notice, which the project calls copyright abuse. (Source)
• Germany’s Sovereign Tech Agency is putting €508,640 into Flatpak to harden the Linux desktop’s app-distribution layer. (Source)
• August set a record for US cities terminating Flock Safety surveillance contracts, per new data from a Bay Area anti-surveillance advocacy group. (Source)
• A vibecoded fuzzer found a division-by-zero bug in FFmpeg, evidence that generated test harnesses can surface real vulnerabilities. (Source)
• OCaml’s cohttp 6.3.0 security release fixes a path-traversal flaw, and its author notes that even the rumour of a bug is enough to drive exploit hunting. (Source)
• Apple is raising prices on Apple TV+ and Apple One, weeks after its previous subscription adjustments. (Source)
• Australia’s official music charts now require releases to be “substantially human made,” barring largely AI-generated songs. (Source)
• The US has sanctioned the a/I Collective (Autistici/Inventati), the Italian autonomous collective that has run encrypted email services since 2001. (Source)

One Line

The empty invocation of national security is not a blank check to punish and retaliate against government critics.

— Judge Rita F. Lin, ruling in Anthropic v. Department of War