The Catch in AI Licenses
Cutting Off Supply Doesn't Require a "Competitor Clause," Because No One Wrote One

On August 28, 2026, OpenAI officially announced it would completely stop providing model access to Cursor on November 12. The reason was stated plainly—"based on the prior contract violations by Elon Musk's companies, we cannot be confident SpaceX will use this technology within the scope of the agreement" (OpenAI official announcement ↗). This was the first time a platform put a shutoff reason directly on equity ownership and trust—not a technical limitation, not a breach determination, just "you changed owners, and we're not comfortable."

It reads like an invocation of a specific clause: some "change of control" trigger mechanism that says "if the customer is acquired/controlled by a specific entity, the provider may terminate." But we went directly to read the full text of OpenAI's own publicly posted Services Agreement (Business Terms), checking clause by clause through the Termination, Suspension, and Competitive Restriction sections—we found no "change of control" trigger clause whatsoever. The only clause involving "successors/assignees" (§16.7 Assignment) says the exact opposite: the contract may be assigned to "a party that succeeds to substantially all of the assets or business," and "shall be binding upon the parties' successors and permitted assigns"—literally meaning that if Cursor is acquired, the contract should automatically continue to the new owner, not automatically terminate.

What actually covers this scenario is another clause designed for a completely different purpose—§8.2's "Security Emergency" suspension right. It defines "Security Emergency" as: "Customer or a Customer End User's use of the Services that could reasonably result in a security risk, credible risk of harm, infringement of third-party rights, or liability to OpenAI, the Services, or a third party". Triggering this doesn't require proving the customer actually breached—it only requires OpenAI's own judgment that it "could" create risk—and it can be executed "without prior notice to the extent reasonably necessary." "Continuing to provide frontier model access to a company like SpaceX, which has a history of contract disputes, could create liability risk for OpenAI"—this judgment fits seamlessly into the Security Emergency definition, without needing a dedicated clause with the words "competitor acquisition" at all.

What's more telling is that the public materials Cursor left behind happen to answer the "why now" question—it wasn't just a change of shareholder. Cursor's own product page states: "Cursor partners with SpaceX on model training," "We trained Grok 4.6 jointly with SpaceXAI," positioning Grok 4.6 directly as "a frontier model from Cursor and SpaceXAI" (cursor.com/grok ↗). In other words, OpenAI was cutting off not "an old customer bought by a competitor," but an old customer that was jointly training a frontier model with a competitor—this is closer to a commercially defensible logic than mere "the equity changed," but OpenAI chose to tell the public the more easily understood "trust" narrative, rather than "we're worried you're feeding our model outputs into Grok's training pipeline"—a more precise but also more evidentially demanding claim.

Update (2026-09):Reading OpenAI's announcement to the end reveals a key statement not covered when checking the public Business Terms—"Our custom agreement with Cursor gives us a limited time window to cancel it after a change of control." OpenAI then explains that for major clients like SpaceX, it "typically rely on custom contracts" to ensure compliance and safety, rather than applying the public Business Terms that any developer agrees to when registering an account (OpenAI official announcement ↗). This adds an important qualification to the article's core finding: the change-of-control clause is not "no one has written one," but rather "no one has written one into public terms"—major clients' one-on-one custom contracts may indeed contain such a clause, but outside readers (including the author when verifying this article) can never see the original contract, and can only learn of its existence when it's triggered, from the parties themselves. Also to clarify: as of this update, November 12 remains only "a proposed shutoff date" in the original announcement; OpenAI emphasized this is already "the longest notice period the contract allows"—meaning this follows a standard termination-upon-expiration procedure with full notice, not the emergency suspension power under §8.2 Security Emergency that can be executed immediately without notice; the actual effective date still depends on subsequent communication between OpenAI and SpaceX/Cursor. Additionally, SpaceX's acquisition of Cursor (parent company Anysphere) was formally completed on August 14, 2026, as an all-stock transaction valued at approximately $60 billion, issuing approximately 391 million shares of SpaceX Class A stock to former shareholders (Bloomberg ↗).

We directly read the original developer/API agreements from OpenAI, Anthropic, Google, and xAI—not news summaries, but the contract clauses themselves. The structure of all four documents is strikingly similar: each has a relatively mild "termination" clause requiring advance notice, and an almost unrestricted "suspension" clause requiring no notice; the power to cut off always comes from the latter.

Looking at all four in the same table, the pattern is clear: not one writes "customer acquired/controlled by a competitor" as an independent termination event—what actually works is a catch-all suspension right with coverage so broad that almost any scenario can be fit into it, and almost all come standard with "without prior notice." This pattern even applies to Anthropic itself: its Commercial Terms hide a more subtle clause (I.3.a(b)) that allows Anthropic to pass through suspension to customers when "any supplier suspends or terminates Anthropic's use of a third-party service/product"—meaning if one of Anthropic's own upstream suppliers cuts it off, it has the right to pass that shutoff directly down to its customers. Shutoffs can propagate downward layer by layer, just like liability.

Figure · Spectrum of shutoff power vagueness across four model vendors—the further left, the more unrestricted the power; the rightmost slot is empty for all vendors

The sole exception appears only at the application layer—as §05 will show, the developer API market player that actually writes "competitive with us" into its termination clause is Perplexity, not any of the four major model vendors. This itself demonstrates something: the stronger the market position and the less the vendor needs customers, the less incentive it has to define the boundaries of its shutoff power clearly.

Cursor wasn't the first AI coding tool to be cut off because it "might be taken by a competitor." Thirteen months earlier, nearly the same script played out in full with Windsurf—the difference being that this time, the "competitor" was a potential buyer, not a completed acquisition.

The point isn't how dramatic this timeline is, but the two "institutional memories" it left behind, both directly verifiable in Cognition's current contracts and product architecture:

First, Cognition's own current platform terms surprisingly do not write "upstream model vendor shutoff" as an explicit downstream disclaimer/pass-through clause—the opposite of Anthropic's own "if our supplier cuts us off, we can cut you off" pass-through clause mentioned earlier: Windsurf/Devin Desktop was burned, but didn't codify this risk in writing into its own contract with users (Cognition Platform ToS ↗).

Second, the product architecture truly learned the lesson—Cognition's Data Processing Appendix (DPA) Appendix C publicly lists sub-processors including OpenAI, Anthropic, Microsoft/Azure, Google/Vertex, plus optional xAI, Databricks, Snowflake (Cognition DPA ↗)—not just saying "we support multi-model," but signing all four major model vendors as named sub-processors. The June 2026 Devin Desktop revision goes further, integrating the open Agent Client Protocol (ACP, initiated by Zed Industries), allowing users to directly switch between Codex (OpenAI), Claude Agent (Anthropic), Gemini CLI (Google), and other third-party agents within the same IDE (Devin Desktop official docs ↗).

But there's a limitation that must be made clear: ACP provides choice, not risk transfer. The official documentation explicitly states—"When using an external ACP agent, all agent operations are delegated to that agent. Devin Desktop's privacy policy and legal terms do not apply, and billing occurs directly between you and the third-party agent provider." In other words, if Anthropic repeats its trick and cuts off some ACP-connected Claude Agent, that's a dispute between the user and Anthropic; Devin Desktop's contract doesn't backstop it. Multi-vendor architecture reduces the probability of "being completely locked out by one vendor," but it doesn't—and doesn't intend to—transfer this risk from the user to the platform.

Shutoff rights only exist in closed-source API contracts; open-weight models don't have this problem—but the word "open source" itself is frequently abused. Checking the four license originals clause by clause, only one is a truly unconditional permissive open-source license.

Three findings worth pulling out separately. First, "open source" in the model world basically means "open weights," not OSI-defined open source—Llama, Qwen flagship, and GLM-5.3 flagship are all explicitly excluded from OSI certification due to "field of use" restrictions like revenue/MAU thresholds (OSI's own words are blunt: "it's not up to you, it's up to OSI"). Second, these threshold numbers actually constrain only a tiny number of ultra-large players—GLM-5.3's $10 billion annual revenue threshold is reachable by companies you can count on two hands; Qwen's actual $50 million threshold is two orders of magnitude lower, but still only catches mid-to-large MaaS resellers, leaving ordinary startups or enterprise internal use well below the threshold. Third, within the same model family, "standard" and "flagship" editions often carry completely different licenses—the QwenLM official GitHub repo README still says "all our open-weight models use the Apache 2.0 license," which holds for the Qwen3 series but no longer holds for the newer Qwen3.8-Max flagship, representing an as-yet-unupdated wording gap.

The four sections above examined how model vendors deal with downstream apps; this section flips the perspective to look at how the apps themselves deal with end users—hidden in the ToS originals of five mainstream AI applications (Cursor, GitHub Copilot, Windsurf/Devin Desktop, Replit, Perplexity) is a shared structural catch: the free/personal edition and the enterprise edition are two almost completely different contracts.

Three details worth expanding on.

First, Cursor's own contract hides the "reverse clause" of the risk it's now suffering. Cursor ToS §17.1 states: "You may not assign these Terms without our prior written consent... We may assign these Terms and all rights under them (including rights relating to your Content) at any time, without notice or consent." This is an entirely one-sided clause—Cursor itself has the unilateral right to assign/be acquired with automatic contract continuation, while users have no equivalent right to refuse. Ironically, this is the mirror image of what OpenAI is actually doing to Cursor: one party's equity/control changes, and the other has no say whatsoever.

Second, GitHub's terms include an uncommon but structurally distinctive "Access Reciprocity" clause: if you use automated means to scrape publicly available content on GitHub to train your own commercial AI model, you automatically forfeit the right that "your own products/datasets" might otherwise have to prohibit GitHub from scraping you in return—and "may not take any technical or other targeted measures to restrict or retaliate against such access." In other words, companies that train models on GitHub data simultaneously lose the right to prevent GitHub/Microsoft from reverse-scraping their own content (exemption: purely academic research, or products with under 700 million annual active users). This isn't a typical SaaS clause; it's a competition-oriented, deliberately designed reciprocal countermeasure.

Third, Perplexity's "competitive means termination" clause is worth viewing alongside the lawsuits it faces. News Corp/Dow Jones, Encyclopaedia Britannica, and Merriam-Webster have all sued Perplexity for unauthorized scraping/paraphrasing of their content—but Perplexity's consumer terms are completely silent on disputes arising from "our own scraping of third-party content," offering users no indemnity commitment; even the paid Enterprise/API terms' sole IP indemnity clause explicitly excludes "free trial/non-paid use." Unhesitatingly writing "if you compete with us, we'll cut you off" while saying nothing about what users should do when Perplexity's own scraping of others' content triggers lawsuits—this contrast itself is a catch worth remembering.