Cursor, the AI coding platform, investigated whether its own employees may have sent confidential client data into SpaceX’s AI systems while testing Grok.
The timing is awkward. The probe reportedly started in late July 2026, just weeks before SpaceX finalized its $60 billion acquisition of Cursor on August 14, 2026.
What set off the investigation
The probe began after engineers raised concerns on Slack. They were worried about how confidential client data was being handled during pre-launch testing of the Grok Bot.
At the center of those warnings was an internal tool called Sand. Employees flagged the risk that Sand might have inadvertently routed sensitive information to SpaceX’s AI division for use in model training.
Cursor’s legal team took the warnings seriously. A company lawyer cautioned that a “serious trust crisis” could follow if these data practices became public.
How Cursor responded
Cursor made two concrete changes after the investigation. First, it restricted access to internal tools so that logins require company email addresses.
Second, Cursor decided to stop using employee-generated data to train models.
Notably, there has been no publicly confirmed evidence that client or partner data was actually exposed. The investigation addressed a potential risk, and so far nothing indicates a confirmed breach.
Why the acquisition timing matters
SpaceX’s $60 billion purchase of Cursor closed on August 14, 2026. The deal folded the platform into SpaceXAI, even as questions about data governance were still circulating.
The investigation took place during the final stretch before that closing. In practice, the probe happened while Cursor was still independent, but the data in question was reportedly flowing toward its soon-to-be parent.
The broader trust problem for AI coding tools
Cursor’s own lawyer recognized the stakes. Describing the potential fallout as a trust crisis suggests the company understood its value depends heavily on clients believing their code is handled carefully.
What this means
For Cursor’s existing clients, the immediate question is assurance. The company has tightened logins and stopped training on employee-generated data, but customers will likely want clarity on whether any of their material was involved.
Still, the story now sits under SpaceX’s ownership. Any future questions about Cursor’s data handling will land on SpaceXAI’s desk, not on a standalone startup’s.
There is also a lesson for acquirers. Buying an AI company means buying its data history, including any informal practices that were never fully documented.
What to watch next is straightforward. Whether any evidence emerges of actual client data exposure will determine if this remains an internal governance story or becomes a much larger one.
Disclosure: This article was edited by Diego Almada Lopez. For more information on how we create and review content, see our Editorial Policy.