3 Model Cutoffs in 14 Months: The Case Against Single-Vendor AI in 2026

At scale, model access stops being a procurement decision and becomes a systems problem. Three AI companies learned this between June 2025 and August 2026, each losing access to a model provider they had built their product on. None of them did anything their own customers would recognize as wrong. In each case the decision was made in a room they were not in, over a dispute they were not party to, and the damage was determined by exactly one variable: how much of their traffic depended on the provider that walked.

For Cursor, that number was 5%. It is why Cursor is negotiating rather than rebuilding, and it is the most useful metric an enterprise AI team can calculate about its own stack this quarter.

Three AI model cutoffs in 14 months: Windsurf, OpenAI, and Cursor

Read the notice column twice. That is the range an enterprise gets to migrate a production dependency: somewhere between five days and eleven weeks, decided unilaterally by the supplier.

Anthropic co-founder Jared Kaplan was unusually direct about the Windsurf decision, telling TechCrunch: "I think it would be odd for us to be selling Claude to OpenAI." Windsurf was pushed toward bring-your-own-key arrangements, which cost its developers more and complicated their setup.

Two months later Anthropic revoked OpenAI's own Claude access, after finding OpenAI engineers using Claude Code to test GPT-5. OpenAI communications chief Hannah Wong called the practice "industry standard to evaluate other AI systems to benchmark progress and improve safety." Both positions are defensible. Neither helped anyone building on top of either company.

Why model provider risk is structural, not a Musk-Altman feud

The easy read on the Cursor cutoff is a feud. Sam Altman and Elon Musk have been in open conflict for years, and Musk's response was "I couldn't care less," alongside calling Altman and Greg Brockman "utterly untrustworthy."

Acting on that read will cost you, because it predicts nothing.

Strip out the personalities and the pattern survives intact. Anthropic cutting off Windsurf had no Musk in it. Anthropic revoking OpenAI's access had no Musk in it. What all three share is a structural condition: your model provider is simultaneously your supplier and your competitor.

OpenAI ships coding products. Anthropic ships coding products. Google ships coding products. When a supplier's roadmap converges with your own, the commercial logic keeping the API open stops being dependable. Add an acquisition, a terms dispute, or a change of ownership, and the relationship ends on contractual notice.

The Cursor numbers make the point at scale. SpaceX closed its $60 billion acquisition of Anysphere on August 14, 2026, the largest acquisition of a venture-backed startup on record. Fifteen days later OpenAI announced it would wind down access, saying it "cannot be confident that SpaceX will use our technology within our terms of service." Cursor had roughly $2.6 billion in annualized revenue and was, by co-founder Michael Truell's account, "one of the very first users of OpenAI." Years of partnership bought eleven weeks. We covered what SpaceX was actually buying when the deal was announced.

Gergely Orosz reached the operational conclusion in June 2026, before the cutoff happened: "Trusting any single AI vendor seems like an increasingly high risk for any team or company. When using models: use it behind a router where it's trivial to switch providers."

How to calculate model concentration risk per workflow

The question is not whether you use multiple models. Most enterprise teams do. The question is what percentage of production traffic fails if your largest provider terminates on 90 days' notice.

Calculate it per workflow, not per organization, the same granularity used to assess agentic workflows generally. Aggregate figures hide the exposure. A company spreading 70% of total traffic across four providers can still have one revenue-critical workflow running 100% on a single model.

Cursor sits in the top row, which is the entire reason this is a news story rather than a corporate obituary. It runs Anthropic, Google, and Grok models alongside OpenAI's. On November 13, 95% of its traffic is unaffected.

Four failure modes of single-vendor AI model dependency

Termination is the dramatic failure and the rarest. The routine ones cost more.

Pricing. A provider with no substitute in your stack sets your unit economics. When switching costs six months of engineering, you accept the increase.

Terms changes. Providers revise acceptable-use policies regularly. A change ruling out your use case is functionally a cutoff, arrives with less notice, and gets no coverage. Anthropic's terms barring use for competing-model development are exactly what ended OpenAI's access in August 2025.

Deprecation. Model versions retire on the provider's schedule. Every prompt, eval, and guardrail tuned to a specific version carries migration cost whose timing you do not control.

Capability lag. No provider leads on every task. OpenAI's own GPT-5.4 mini and nano releases validated task-based routing rather than single-model defaults. A team locked to one runs whatever that provider is currently worst at. With capability spread across OpenAI, Anthropic, Google, and several open-weight families in 2026, single-vendor teams give up accuracy on some share of their workload every quarter.

Termination gets the headline. Pricing and deprecation take more money out of more budgets.

When a single-vendor AI model strategy is the right call

Portability is a cost, and there are cases where paying it is wrong.

Pre-product-market-fit teams should optimize for speed. If you are still finding out what the product is, maintaining four provider integrations is engineering spent on a risk that has not earned attention yet. Ship on one, instrument concentration, revisit at scale.

Some workflows depend on a specific capability. If one provider is meaningfully ahead on the exact task your product is built around, routing around it means shipping a worse product to hedge a risk that may not land. Take the dependency deliberately, write down what breaks if it disappears, and review it quarterly.

Low-volume internal tooling rarely justifies the overhead. A workflow summarizing internal tickets does not need a tested fallback. The cost of a two-week outage is an inconvenience, not a business event.

Enterprise agreements change the math. A committed contract with defined termination terms is genuinely different from consuming a public API under standard terms. It is not immunity, as Cursor demonstrated, but it converts an arbitrary decision into a negotiated one with a known notice period.

The distinction that matters is not single-vendor versus multi-vendor. It is whether the dependency is deliberate. Cursor's 5% was not an accident, and it was not free either: it required maintaining integrations across four providers for years before any of it paid off. Windsurf's dependency, by contrast, only became visible when Anthropic gave it five days.

Concentration you chose and priced is a strategy. Concentration you discovered during an outage is a failure.

What multi-model portability actually costs to build

Multi-model architecture is not free, and anyone claiming otherwise is selling something.

• Prompt portability is imperfect. Prompts tuned for one model family lose accuracy on another. Budget re-tuning per workflow, not a config change.

• Evaluation overhead multiplies. Every supported model is another eval suite to maintain against every workflow.

• Cost and latency vary by provider, making capacity planning harder.

• Feature parity is not guaranteed. Tool-calling formats, structured output, context windows, and caching behavior all differ. Google's Gemini Enterprise ships access to 200+ models, and breadth of choice is not the same as portability across it.

The honest trade: portability costs real engineering time and buys the right to make your own decisions about your own product. For a low-stakes workflow that may not be worth it. For a workflow your revenue depends on, being unable to switch providers is a business risk parked in an engineering budget line.

Teams that got this right did not build portability after a cutoff. They built it when the concentration number got uncomfortable.

The multi-model architecture that absorbs a provider cutoff

Four properties separate stacks that route around a provider loss from stacks that go down with it.

An abstraction layer between workflow logic and provider APIs. If provider-specific calls are scattered through business logic, switching is a rewrite. Behind one interface, switching is a config change plus re-tuning.

Per-workflow model assignment rather than global defaults. Different tasks have different best-fit models. Assigning per workflow means a provider loss degrades a subset instead of everything.

Evaluation suites running against every supported provider. Portability you have not tested is portability you do not have. The test: can you produce current accuracy numbers for your second-choice provider today?

Provider-level observability. You cannot manage concentration you cannot measure. Per-workflow, per-provider traffic belongs on a dashboard, not in a research project.

Beam's multi-agent orchestration patterns are built on these four properties, as is the underlying platform.

None of these are novel. They are the same separation-of-concerns principles that govern any system with a replaceable dependency, applied to a layer most teams treated as fixed until 2025. The durable asset is the workflow logic. The model is an input.

A 90-day model concentration audit for enterprise AI teams

Cursor's shutoff is November 12, 2026. Borrow the deadline.

1. Calculate concentration per critical workflow. One number each: share of production traffic on the largest provider.

2. Rank by revenue exposure, not volume. The workflow that closes deals matters more than the one summarizing tickets.

3. Pick the top three and establish a tested fallback. Not a plan. A tested path with current accuracy numbers.

4. Audit contracts for termination notice. OpenAI gave Cursor the maximum its contract allowed and that was eleven weeks. Windsurf got under five days. Know your number before you need it.

5. Set a concentration ceiling for new workflows and review quarterly.

None of this requires predicting who does this next. That is the point. The teams unaffected on November 12 are not the ones who guessed right about OpenAI and SpaceX. They are the ones for whom the answer was 5%.

Frequently asked questions

What happened between OpenAI and Cursor?

OpenAI announced on August 29, 2026 that it will stop serving its models to Cursor, with a proposed shutoff of November 12, 2026. It followed SpaceX's $60 billion acquisition of Cursor parent Anysphere, which closed August 14, 2026, and was reported across major outlets. OpenAI cited an inability to trust that SpaceX would honor its terms of service.

How much of Cursor is affected?

About 5% of Cursor user traffic, according to co-founder Michael Truell. Cursor continues to offer Anthropic, Google, and Grok models.

Has this happened before?

Twice in the preceding fourteen months. Anthropic cut off Windsurf in June 2025 with under five days of notice amid reports OpenAI was acquiring it, and revoked OpenAI's own Claude access in August 2025 over a terms violation involving GPT-5 benchmarking.

What is model concentration risk?

The share of production traffic in a given workflow that depends on a single model provider. Beam's ModelMesh approach treats this as a routing property rather than a procurement one. Above roughly 50% in a revenue-critical workflow, a provider cutoff, price change, or deprecation becomes a business event rather than a migration ticket.

How do enterprises reduce it?

Put an abstraction layer between workflow logic and provider APIs, assign models per workflow rather than globally, maintain evaluation suites for every supported provider, and monitor per-provider traffic so concentration is measurable.

Why model concentration decides the outcome

Three cutoffs in fourteen months, involving both leading providers, none caused by the companies that absorbed them. Concentration decided the outcome every time.

Michael Truell's framing of what went wrong deserves sitting with: Cursor "trusted their platform to be neutral infrastructure."

No model provider is neutral infrastructure. They are suppliers with their own products, their own competitors, and their own legal teams. Architect accordingly.