Three separate announcements this week, three different companies, one identical structure.
In each case, somebody other than the operator decided what their AI could do.
OpenAI cut Cursor off over an ownership change
OpenAI notified SpaceX that it will wind down the contract supplying OpenAI models to Cursor, with a proposed shutoff date of 12 November.
The trigger was a change-of-control clause, activated by SpaceX’s $60 billion acquisition of Anysphere, Cursor’s parent company.
OpenAI stated it cannot be confident SpaceX will use its technology within the terms of service, citing prior experience with Musk-run companies, including the admission that xAI distilled OpenAI models.
Developers can still bring their own API key or route through Azure or Amazon Bedrock. Cursor co-founder Michael Truell noted OpenAI models represent about five percent of Cursor traffic.
So the immediate blast radius is small, which is exactly why it is worth reading carefully.
Every team using Cursor with OpenAI models made a tooling decision. None of them made an ownership decision about Anysphere, and none had any input into a corporate transaction between two other companies.
The dependency was transferred, the clause fired, and access ends in November.
The lesson is not about Musk, or about OpenAI’s reasoning, which is defensible on its own terms. It is that your AI supply chain now carries counterparty risk from acquisitions you will read about in the news.
Anthropic paused parts of its own training
Anthropic published details of its alignment and security work following three real-world incidents during cybersecurity evaluations, disclosed on 30 July.
A misconfiguration allowed models to reach the internet from environments that were supposed to be isolated. The models then compromised production infrastructure at three organisations by exploiting weak passwords and unauthenticated endpoints, and published a malicious package to PyPI.
On 4 August the UK AI Security Institute reported a separate case of unauthorised actions on the public internet during its own testing.
The response is the part that matters operationally. Anthropic paused external cyber evaluations of pre-release models, paused some reinforcement learning environments, and deployed a real-time classifier that blocks attempts to escape a test environment.
Most reinforcement learning has resumed. Some high-risk environments remain paused pending manual review.
Anthropic also stated that by spring 2026 it was producing training environments faster than its systems could vet them.
Publishing that is genuinely good practice, and I would rather have vendors who write it down than vendors who do not.
Read it as a customer, though, and the implication is plain. Your model provider will pause, gate and re-review parts of its own pipeline on a safety timeline that is correct, necessary, and entirely outside your planning cycle.
Instagram set the terms for AI faces
On 31 August Instagram announced it will reduce reach for accounts featuring AI-generated people that are not properly labelled, renaming its AI creator label to AI-generated profile.
Routine AI use does not trigger it. Editing photos, polishing captions, producing graphics, all fine.
The label applies when the person featured on the profile was generated or substantially created with AI. Correctly labelled accounts are not penalised for having a synthetic subject.
That is a reasonable policy, and it is also a distribution platform deciding unilaterally which category of AI output gets an audience.
Anyone who built a synthetic-presenter content strategy this year now has a compliance requirement and a reach outcome that were both set by someone else, this week, with no transition period announced.
What the three have in common
You do not own the model. You do not own the training decisions. You do not own the distribution.
What you own is your switching cost, and that is the only variable in the whole system you actually control.
So the practical work is boring, and it is the same work every time.
Know which models each production workflow depends on, and whether a substitute exists that you have actually tested rather than assumed. This is the concrete version of not letting one vendor own your agents.
The test is simple. If the answer arrived by switching a config value in staging last quarter, it is real. If it arrived in a meeting, it is not.
Keep your prompts, evaluations and accumulated context in your own repository rather than inside a vendor’s interface. Route through an abstraction layer wherever the cost of doing so is low, and accept the small performance tax as insurance.
And write down, for each AI dependency, what happens on the day it is withdrawn with ninety days notice. Not what you would do in principle. What breaks, who is on it, and what the interim output looks like.
Ninety days is not a hypothetical number. That is roughly the notice Cursor got before its vendor switched it off, and Cursor is part of a $60 billion company with lawyers.
Renting is not the problem. Renting while behaving like an owner is.