Analysis
Cursor's own engineers opened an internal investigation in late July 2026 into whether confidential client and partner data had been routed into SpaceX's AI systems while staff tested Grok, according to CryptoBriefing. The probe began just weeks before SpaceX's $60 billion acquisition of Cursor closed on August 14, folding the AI coding startup into SpaceXAI.
## What Cursor's engineers found The concern centered on an internal tool called Sand, which employees worried might have unintentionally sent sensitive client information to SpaceX's AI division for use in model training during pre-launch testing of the Grok Bot. Engineers first raised the issue on Slack, and a Cursor lawyer reportedly warned that a 'serious trust crisis' could follow if the practices became public. In response, Cursor restricted internal tool logins to company email addresses and stopped using employee-generated data to train models. There is no on-the-record public statement from Cursor or SpaceX on the probe.
“Engineers first raised the issue on Slack, and a Cursor lawyer reportedly warned that a 'serious trust crisis' could follow if the practices became public.”
Cursor -- formerly Anysphere -- built one of the most widely used AI coding assistants, competing with GitHub Copilot, Replit's AI tools, and Windsurf in a crowded market for AI-assisted software development. SpaceX's acquisition folded that product into SpaceX's broader AI push alongside Grok, extending Elon Musk's AI ambitions from rockets and xAI into developer tooling.
The timing matters: a data-handling investigation opening weeks before an acquisition closes is the kind of finding that normally surfaces during due diligence, not after a Slack thread. However, there's no public confirmation that client data was actually exposed -- the probe identified a risk, not a confirmed breach, and no regulator has opened a formal inquiry into Cursor specifically over this episode. Separately, Ireland's Data Protection Commission has an open 2025 inquiry into whether Grok's training lawfully used public posts from EU users, but that case predates and is unrelated to the Cursor matter.
What to watch: whether SpaceX discloses any findings from its own post-acquisition review of Cursor's data practices, and whether enterprise customers who relied on Cursor's confidentiality commitments seek contractual assurances now that the product sits inside a company racing to train Grok on every available data source.
