The 5% Test
every AI startup should run today

On August 28, 2026, OpenAI told SpaceX it would stop supplying models to Cursor. The proposed shutoff date is November 12, 2026. That is 76 days of notice, which OpenAI describes as the maximum notice its contract allows.

The trigger was ownership, not usage. SpaceX closed a $60 billion all-stock acquisition of Anysphere, the company behind Cursor, on August 14. Fourteen days later, the termination notice landed.

Here is the number almost every write-up buried. Cursor CEO Michael Truell said OpenAI models account for roughly 5% of Cursor's user traffic. The coding tool everyone assumed was an OpenAI wrapper mostly wasn't.

That 5% is the whole lesson. Not the feud, not the drama, not the "AI gatekeeper" headline. A company got fired by its most famous supplier and kept working, because it had spent years making sure it could.

The 5% Test

Every product built on someone else's model has a number. It is the share of your value that dies the day one provider says no. Cursor's number was 5%. Most AI startups have never measured theirs, and I would bet plenty are north of 90%.

Run the test and you land in one of three tiers.

Tier one is Single-Source. One provider, one API, no fallback path, no evaluation harness for alternatives. A change-of-control clause or a rate limit rewrites your roadmap for you, and you find out by email.

Tier two is Multi-Homed. You route across two or more providers behind your own interface, and you have actually tested the switch under load. Losing a supplier costs you a bad week, not the company.

Tier three is Owner. You ship at least one model you control, even a weaker one. Cursor sits here. It has its own Composer model, plus Grok, Anthropic's Claude, and Google's Gemini. It shipped Grok 4.5 with SpaceXAI in July 2026 across every plan.

The 5% Test is not a technical audit. It is a question about power. Who can change your product without your permission, and how long would you have to react?

Contracts Are the Real Product Spec

Read OpenAI's post carefully and the interesting sentence is not about Elon Musk. It is this: "Our custom agreement with Cursor gives us a limited time window to cancel it after a change of control."

Someone wrote that clause years ago. OpenAI says it worked with Cursor for nearly four years. The strategic move happened at signature, not at announcement. The August 28 notice was just the option being exercised.

That is how long-arc leverage gets built. Not in the press release. In the paperwork nobody reads at Series A. A vendor sells you capability. A gatekeeper sells you permission, and the difference is written into a clause you skimmed.

The stated reason matters too, because it defines the new eligibility test. Trust history is now an input to model access.

Then comes the forward-looking part. OpenAI said it has "a new level of accountability" around its upcoming model, Astra, and will not supply future models to Cursor at all. That is the real shift. Not a shutoff of what exists, but a locked door on what comes next.

Now the damaging admission, because the gatekeeper framing is oversold. This is not a kill switch. After the proposed transition period of November 12, 2026, Cursor users would still be able to bring their own OpenAI API key for Chat and Agent features. They can run a Codex IDE extension inside Cursor. They can route through a gateway like Amazon Bedrock or Azure.

So the honest version of the thesis is narrower and more useful. Frontier providers hold real contractual leverage over downstream tools, and that leverage sharpens when the provider also competes in the same product category. OpenAI ships coding tools. It is not neutral infrastructure and never was.

The counterpositioning here runs both ways, which is the part I find most interesting. OpenAI protected its frontier tier from a rival's flagship distribution. SpaceX got a coding tool that now routes traffic to Grok by default. Both sides traded reach for control, and it is unclear whether either trade pays off.

There is a second signal in the same news cycle worth holding next to this one. More than 100 organizations, including Google and Anthropic, signed a cross-industry letter on AI cyber-defense. When the frontier labs start coordinating on capability risk, tiered access stops being a business tactic and starts becoming policy.

Notice how neatly "accountability" and "competitive advantage" point in the same direction. Astra is withheld from a rival's product for safety reasons that are also, conveniently, strategic reasons. Both things can be true at once. That is precisely why this pattern will spread.

Three signals inside the same shift

2031

Zoom out five years and the Cursor episode looks small. What it seeded is not.

Model access is migrating out of engineering and into procurement and legal. In 2026, most startups pick a model by benchmark score. By 2031, I expect the serious ones to pick by contract terms: notice periods, change-of-control symmetry, future-model commitments, price protection. Capability converges. Terms do not.

Here is the contrast pair worth taping to your monitor. Integration buys you speed this quarter. Ownership buys you optionality for the decade. Cursor bought both, and that is why a $60 billion acquisition plus a supplier termination cost it roughly 5% of traffic instead of its existence.

The compounding effect is quiet. Every month you run two providers behind one interface, you build a small asset: proof that you can switch. Every month you run one, you build a small liability that nobody records on the balance sheet.

Look at the shape of past platform shifts. Twitter cut off free API access in 2023, and third-party clients that had thrived for a decade died in weeks. The apps that survived had already stopped being Twitter clients. Nobody gets a warning shot twice.

Approach your own stack with beginner's mind. Not "which model is best," but "what happens Monday morning if this vendor emails me a termination notice." Only what you can run tomorrow is real. The rest is a contract.

What to Build This Weekend

Start with the audit, not the code. Open a blank doc and list every model call your product makes. Next to each, write the provider and the rough share of total calls. That is your 5% Test, and it takes an hour.

Then build a router. One internal function, two providers behind it, same input and output shape. Point it at your primary model, then force it to the backup and run your ten hardest real prompts. Things will break. That is the point of doing it on a Saturday instead of during an outage.

Third, own your retrieval layer. RAG just means your model reads from your documents before it answers. Firecrawl's Developer Index indexes more than 70 million artifacts built specifically as retrieval for coding agents, so your context does not have to live inside one vendor's product. If you swap models, your knowledge base should not care.

Fourth, own your context capture. screenpipe records your real work sessions and turns them into agent memory. Caddi builds an agent from a single demonstration instead of a written spec, so you show it once rather than writing a prompt document. Ruflo AI gives you a hosted workspace where several agents work a codebase together. Pick one, wire it to your router, and keep the exported data somewhere you control.

Fifth, read your contracts. Search the PDF for "change of control," "assignment," and "termination." If your provider has an exit option and you do not, you know which side of the table you are on.

Do not try all five. Pick one, finish it, ship it. The teams that survive the next supplier decision are not the ones with the smartest model. They are the ones who already practiced losing it.