SpaceX bought its own tenant the week open weights caught up

Two data points landed on the same day and they belong in the same paragraph. SpaceX is acquiring Cursor while running $28B/yr in AI compute — Anthropic at $1.25B/month, Reflection AI at $150M/month, Google undisclosed — with a $20B bond issuance queued behind it. And GLM-5.2, an open-weight model from Zhipu, ranked #3 on GDPval-AA at 1524 Elo and shipped cleaner code than Opus 4.8 on Cline's bug-fix runs, at $0.41 per task against Opus at $0.81.

Those facts point in opposite directions if you squint. Read them together and they describe the same market: compute is consolidating up the stack while intelligence is commoditizing down it. Whoever ships next quarter has to price both moves into the same roadmap.

The Cursor acquisition is the real story

SpaceX didn't buy an IDE. It bought captive distribution for its compute. AWS ran this playbook with Lambda — nothing in the docs said prefer Lambda, the defaults did. Cursor will get quietly tuned for the model partners already on the customer list (Anthropic, Google) and quietly worse on everything outside it. The acquisition takes months to show up in the product. The incentive gradient is already live.

The 90-day exit clauses running through every SpaceX compute contract are the tell. $28B of revenue that can walk in a quarter isn't a moat — it's a spot market wearing an enterprise suit. Which is why owning Cursor matters: distribution locks in the demand that the contract terms don't.

Yes, but — the counter-reading is that 90-day outs give Anthropic and Google real leverage, and a talent-flow shock (Google shed 5.08% in one session on AI departures alone) can crater any vertical stack faster than the acquisitions close. Fair. It still doesn't help you if you're piping proprietary code through an IDE whose parent competes with your model vendor. The concentration risk got worse this week, not better.

If your team runs Cursor on sensitive repos, audit what leaves the machine and qualify Zed or Continue.dev in staging by end of sprint. Not as a migration — as a documented exit. Your procurement team also just got the cleanest public GPU price comp in existence: $10+/hr Blackwell with 90-day flexibility. Take that number into every reserved-capacity conversation this quarter. Anyone quoting worse terms is now off-market.

GLM-5.2 is the switch decision you can't see yet

The headline number is that GLM-5.2 costs 49% less than Opus per agentic task. The more interesting number is behavioral: on Cline's bug-fix bench, GLM ran more tool calls, verified builds, removed dead code. Opus was faster and left type errors that silently passed tests. That's the profile you actually want from an autonomous coding agent — cautious, verification-heavy, willing to spend a tool call to be sure. It's n=1 on someone else's codebase. Don't migrate on it. Do run your own hundred-task shootout this week.

Here's the part that gates the decision. A 541K-judgment audit across 21 LLM judges and 9 providers found that swapping exact-match agreement for Cohen's kappa deflates MT-Bench agreement scores by 33–41 points. Judge rankings reorder under the correction. If your model-switch gate uses raw judge agreement — and most teams' gates do, because kappa was a footnote nobody read — then GLM-5.2 may already be competitive on your traffic and your eval harness is hiding it. Worse: any A/B decision you shipped last quarter based on those scores was measuring class-imbalance noise dressed as quality.

Patch the harness before you run the shootout. Report kappa alongside exact-match. Re-score the last quarter of release decisions. It's a Friday afternoon of work and it will change what you thought you knew about at least one of them.

The dual-use symmetry nobody's SBOM captures

OpenAI's Daybreak has now merged AI-authored patches into cURL, the Go runtime, CPython, Sigstore, and pyca/cryptography — 70K reviewer-marked fixes, 500K auto-detected patches, all shipped code you already depend on. In parallel, OpenAI released GPT-5.5-Cyber, which claims SOTA on CyberGym and ships commercially with no export controls. Anthropic put export restrictions on the comparable Mythos/Fable models. OpenAI didn't. The same model class writing the patches is available to write the exploits.

No SCA tool flags AI-authored upstream commits today. Snyk, Dependabot, FOSSA — none of them separate human from machine authorship in your dependency graph. That is a SLSA provenance gap auditors will start asking about inside six months. If your crypto or TLS libraries carry Daybreak-attributed commits, require two-human sign-off on the internal fork this week. It's a branch protection rule, not a project.

What to actually do this week

One thing, if you only do one: instrument Cohen's kappa in your eval pipeline and re-score your last three model-comparison decisions. If any of them flip, you have a bigger problem than which model to use next — you have an eval harness that has been green-lighting regressions and calling them upgrades. Fix the measurement before you touch the model. The GLM-5.2 shootout, the Cursor exit plan, the SBOM audit for AI-authored commits — all of that runs on top of an eval you can trust. Right now most teams don't have one, and this is the week that stopped being a footnote.