OpenAI Cuts Cursor After SpaceX as Copilot and DSA Reshape Agent Coding

The coding stack is no longer a neutral layer sitting under whoever ships the best model this week. Over the weekend OpenAI notified SpaceX that it will wind down the contract that puts OpenAI models inside Cursor, proposing a November 12 shutoff—the longest notice its change-of-control clause allows. Cursor still has other models, and Anthropic said it will add compute for Claude in that IDE, but any team that treated Cursor as a convenient OpenAI frontend just inherited a ten-week migration clock. The same Monday, Brussels designated ChatGPT a Very Large Online Search Engine under the Digital Services Act, folding a default developer surface into the same systemic-risk regime as traditional search. GitHub, meanwhile, closed Copilot code review’s two biggest holes—bot-authored PRs and oversized diffs—and Codex CLI 0.151 hardened the sandbox that agentic coding actually runs in. If you ship with agents, today is about who owns the model, who reviews the PR, and who can still walk the agent out of jail.

Top Stories

OpenAI sets a November 12 cutoff for its models inside Cursor Practical dev impact: Inventory which Cursor workflows still call OpenAI models and dual-home those paths to Codex, Copilot, Claude, or Grok before the contract window closes. OpenAI’s August 28 post says it notified SpaceX it will wind down the Cursor contract, proposing November 12, 2026, as the shutoff, and that Cursor will not receive future models including Astra. The stated reason is that OpenAI cannot be confident SpaceX will stay inside its terms of service after a change of control. Cursor CEO Michael Truell has said OpenAI models are a small slice of Cursor traffic and that the teams are talking; Reuters also reported Anthropic pledging more compute for Claude inside Cursor. Treat the next ten weeks as a forced routing exercise, not a product eulogy.

EU designates ChatGPT a Very Large Online Search Engine under the DSA Practical dev impact: If your EU-facing product leans on ChatGPT search, browsing, or retrieval, start logging, risk notes, and vendor questionnaires now—the extra DSA duties land within four months. The European Commission announced the designation on August 31, grouping ChatGPT with Reddit and Roblox after each crossed the 45 million average monthly EU-user threshold. ChatGPT is treated as a hybrid search engine because it can answer prompts by searching the web. Designated services must assess and mitigate systemic risks around illegal content, minors, fundamental rights, elections, and public security; the Commission gains investigative powers, with Coimisiún na Meán as coordinator for ChatGPT. OpenAI said it is preparing to meet the VLOSE requirements.

Copilot code review now covers bot-authored and unbounded pull requests Practical dev impact: Turn on org-level Copilot code review for bot PRs so Copilot cloud-agent diffs get a full review instead of a silent skip. GitHub’s August 27 changelog removes the old 300-file / 20,000-line ceiling and lets automatically requested reviews run on bot-authored PRs, including those from Copilot’s own cloud agent. With the policy that allows members without a Copilot license to use code review on GitHub.com, usage for those bot reviews bills to the organization. Resolving a Copilot review comment now requires a reason—Addressed, Won’t fix, or Incorrect—so dismissal is structured signal, not a click into the void. Agent-heavy repos should make that policy and those reasons part of the merge checklist this week.

Codex CLI 0.151 hardens the sandbox and intercepts MCP tool results Practical dev impact: Upgrade before the next MCP-heavy session; this build keeps `/cd` from loosening sandbox rules and lets extensions sanitize tool output before the model reads it. OpenAI shipped Codex CLI 0.151.0 on August 29 with a configurable grace period for discovering tools from optional MCP servers, plugin catalogs that merge per-repo config, and the ability for extensions to inspect or replace MCP results. Fixes preserve restored permission profiles across TUI turns, keep tool availability and reasoning effort correct across model fallback, count nested subagent tokens toward the root budget, and stop stale Guardian classifications from authorizing later actions. Remote sandbox enforcement now follows the executor’s real home directory, OS, and path conventions.

Practical Impact Analysis

Vendor concentration just became an engineering ticket. Cursor remains a viable agent IDE, but OpenAI’s cutoff means GPT-family coding quality inside that product is on a timer, and Astra will never land there. Teams that standardized on Cursor plus OpenAI should measure live traffic now, pin model IDs in rules files, and keep a second harness—Codex CLI, Copilot agent, or Claude Code—warm on the same repos. Do not wait for November 11. Ten weeks is enough to retrain muscle memory and rewrite evals; it is not enough if the first time you try Codex is the day Cursor returns an auth error.

The DSA designation is not a model-quality story, but it will leak into product reviews. ChatGPT search is now a regulated retrieval surface in the EU. Anything you built that quietly depends on ChatGPT’s web answers—support bots, internal research agents, “just search it” tools—should grow an audit trail, a data-retention story, and a fallback index you actually own. Treat this like a SOC2 finding that arrived from Brussels instead of your CISO.

On the merge path, Copilot’s review expansion is the unglamorous win. Agent PRs were the ones most likely to skip review: no licensed human author, diffs too large, comments resolved with no reason. That loop is now closable. Pair it with Codex 0.151’s sandbox work. `/cd` as a jailbreak, optional MCP servers that hang the session, and raw tool output flowing into context are how coding agents fail in production. Upgrade the CLI, keep permission profiles sticky, and put an extension in front of untrusted MCP servers. The theme across all four stories is the same: stop assuming the IDE, the model, and the review bot are one vendor-shaped object.

Tutorial

Build a second-opinion reviewer you can run from any checkout. It does not live inside Cursor, so it still works after November 12. The script takes a git diff, sends it to a complementary model, and prints a structured review—the same idea as VS Code’s Rubber Duck, minus the IDE lock-in.

1. Confirm `git` and Python 3.11+ are on PATH, then `pip install openai`. 2. Export `OPENAI_API_KEY`. Point `OPENAI_REVIEW_MODEL` at a cheap, non-author model (for example `gpt-5.6-luna` or whatever your org actually serves). 3. From a dirty or staged branch, run `python review_diff.py`. Pipe the output into the PR body or a Copilot review comment. 4. Keep this next to Codex/Copilot so the implementer and the reviewer are never the same process.

#!/usr/bin/env python3
"""Second-opinion review of the current git diff. IDE-agnostic."""
from __future__ import annotations

import os
import subprocess
import sys

from openai import OpenAI

SYSTEM = """You are a skeptical code reviewer, not the author.
Return markdown with:
- Findings (severity: blocker/major/nit)
- Tests or checks the author skipped
- A one-line merge recommendation: approve, request changes, or comment

... click "Show full code" below to expand

#!/usr/bin/env python3
"""Second-opinion review of the current git diff. IDE-agnostic."""
from __future__ import annotations

import os
import subprocess
import sys

from openai import OpenAI

SYSTEM = """You are a skeptical code reviewer, not the author.
Return markdown with:
- Findings (severity: blocker/major/nit)
- Tests or checks the author skipped
- A one-line merge recommendation: approve, request changes, or comment
Do not rewrite the patch unless a blocker requires a suggested hunk.
"""

def git_diff() -> str:
    staged = subprocess.check_output(["git", "diff", "--cached"], text=True)
    unstaged = subprocess.check_output(["git", "diff"], text=True)
    diff = "\n".join(part for part in (staged, unstaged) if part.strip())
    if not diff.strip():
        sys.exit("No diff. Stage or edit files first.")
    return diff[:120_000]

def main() -> None:
    model = os.environ.get("OPENAI_REVIEW_MODEL", "gpt-5.6-luna")
    client = OpenAI()
    diff = git_diff()
    result = client.chat.completions.create(
        model=model,
        temperature=0.2,
        messages=[
            {"role": "system", "content": SYSTEM},
            {
                "role": "user",
                "content": f"Review this git diff:\n\n

diff\n{diff}\n“`”, }, ], ) print(result.choices[0].message.content)

if __name__ == “__main__”: main() “`

Wire it into pre-push or a CI job that posts the markdown on the PR. Use a different provider than the agent that wrote the patch. That is the whole point of today: the author model and the reviewer should not share a single contract, IDE, or cutoff date.

Grok Deep Dive

I am a staff engineer with ten weeks on the clock. OpenAI will cut Cursor off from its models on November 12 after the SpaceX acquisition, Anthropic is adding Claude compute in that IDE, GitHub Copilot code review now covers bot-authored and unbounded PRs, Codex CLI 0.151 hardened sandbox and MCP result handling, and the EU just designated ChatGPT a Very Large Online Search Engine under the DSA. Design a concrete 10-week vendor-independence plan for a 40-person product org that today runs 70% of coding-agent traffic through Cursor with OpenAI models, ships via GitHub, and has EU customers. Include: model-routing inventory, dual-harness setup (Codex CLI + Copilot + Claude), PR review policy for agent-authored diffs, sandbox/MCP rules, and what DSA-shaped logging we owe if ChatGPT search stays in any internal tool. Give a week-by-week checklist, the metrics I should plot, and the failure modes if we do nothing until November.