#148

Cursor's OpenAI access ends November 12, and GLM-5.3's weights land with a $10B clause

OpenAI is winding down the contract that puts its models inside Cursor, with a proposed shutoff of November 12. GLM-5.3's open weights landed the same week.

Cursor’s model picker is about to get shorter. SpaceX closing the acquisition two weeks ago opened a cancellation window in the OpenAI contract. OpenAI took it, and proposes a shutoff on November 12.

The whole pitch was one editor, every frontier model. Nothing in it survives a supplier deciding it doesn’t like who just bought you.

In today’s indie hacker news:

  • 🔌 Cursor’s OpenAI models get an expiry date
  • 🧊 GLM-5.3’s weights are public, with one license catch
  • ⌨️ A post about keyboards, an argument about screen readers
  • 🔐 Stack: a vault that tells you not to trust it yet

TOP STORIES

THE SLOWEST POSSIBLE CANCELLATION

🔌 OpenAI is winding down the contract that puts its models inside Cursor

Editorial cartoon: a giant suited hand slowly pulls an oversized power plug from a wall socket, one pin still sparking, while a small developer at a desk looks up from his laptop; a snail rides on the plug.

The story: OpenAI notified SpaceX on Friday that Cursor’s bundled access to its models is ending. Its stated reason is trust: it can’t be confident the new owner will stay inside its terms. The evidence it cites is Musk’s sworn admission that xAI distilled OpenAI models.

The details:

  • OpenAI never writes “terminate.” The post says wind down and cancel, and calls the shutoff date “the maximum notice provided by our contract.”
  • Cursor CEO Michael Truell puts OpenAI models at about 5% of Cursor traffic. He’s an interested party.
  • HN wants to know whether bring-your-own-key access survives. OpenAI’s post doesn’t say.
  • OpenAI also cites accountability for Astra, its next model. The thread read that as the actual motive.

Why builders care: If any of your work routes through OpenAI models inside Cursor, move it to the API, Codex CLI or another editor now. And if your own product resells someone else’s model, your change-of-control clause is tonight’s reading.

Z.AI WROTE THE CLAUSE FOR AWS

🧊 GLM-5.3’s full weights are public, and the one license condition needs $10B to trigger

Editorial cartoon: a small developer walks out of a wide-open bank vault carrying a server box, while a towering cloud-headed corporate giant is stopped at the threshold by a knee-high velvet rope.

The story: Z.ai dropped the full weights on Hugging Face, after the API-only launch we ran in #134. The LICENSE file is custom Z.AI, not MIT. Its single condition is a security review, and it only reaches Model-as-a-Service operators clearing $10 billion in trailing revenue.

The details:

  • Unsloth’s smallest quant is 254GB on disk and runs on one 24GB GPU with 256GB of system RAM.
  • It holds roughly 81% of full-precision accuracy. The 8-bit build wants 810GB, which is rack hardware.
  • Artificial Analysis scores it 60, level with Kimi K3, and it’s the only benchmark here Z.ai didn’t run itself.
  • One HN commenter gets 10 tokens a second out of a $5,000 used dual-Epyc box.

Why builders care: You can self-host, fine-tune and resell this without asking Z.ai for anything. If you’re paying Opus-tier rates for a coding agent, price a rented GPU box against this month’s API bill before you renew.

THE ARGUMENT HE NEVER MADE

⌨️ A hedged post about keyboard shortcuts became HN’s biggest accessibility fight

Editorial cartoon: a developer holds up one small glowing blank keycap, and its shadow on the wall behind him is a huge many-armed mob of shouting faces and pointing fingers.

The story: Charalampos Kardaris rebutted one line in Thomas Ptacek’s “Stop Making TUIs”: that terminal apps win because they’re keyboard-driven. GUIs can do the same, he argues, and mostly don’t bother. 686 points, 335 comments.

The details:

  • The words accessibility, screen reader and WCAG appear nowhere in the post.
  • Ptacek showed up in the thread to argue GUIs keep a separate accessibility tree, while TUIs signal in-band and read out as brackets and dashes.
  • onion2k pinned it to the spec: keyboard access is WCAG 2.1.1, Level A, the lowest conformance tier there is.
  • abejora’s team scoped v1 as keyboard-first and walked it back when the design cost stacked up.

Why builders care: Set the bar at every action reachable by keyboard and stop there. A command palette covers most of it, and it only stays cheap if you wire it to one central action registry from day one.

🐛 Just the rumour of a bug is enough to find the exploit - Cambridge’s Anil Madhavapeddy patched a path-traversal hole in OCaml’s cohttp, then found probes matching that exact pattern in his own webserver logs ten minutes after opening the PR. An agent had already built him a working exploit from a rough description in under a minute. 280 points. Simon Willison adds rclone’s numbers: about 20 disclosures in a decade, 40+ last month.

📉 Reddit traffic keeps stalling at signup - Four threads in sixteen hours, all stuck at the same step. One builder posted three weeks of Sentrint funnel math: 1,200 visitors, 17 signups, 6 paying. His own read: “Signup to paid is 35%, which sounds great but visit to signup is 1.4% which is the real problem.” A parallel experiment has 65,000 Reddit views and 4 app users.

DRAMA

🚫 TWO DOMAINS, TWO OUTCOMES

OFAC sanctioned Italian hosting collective Autistici/Inventati on August 26. US persons have until September 25 to end dealings. The collective denies the allegations. The .org registry suspended autistici.org, a Gandi registration, within hours, while noblogs.org routes through Tucows to njal.la and stayed up. Inventory your registrar, host and payment processor by jurisdiction.

FIRST DOLLAR

🧶 FIRST SALE, AMOUNT UNDISCLOSED

u/shleemypant posted a screenshot and no body text at all. Asked what it was, he answered in the replies: KnotCMS, which syncs a client’s Notion database into Framer CMS so agencies never hand over the login. Free tier is one project and three manual syncs, Pro is $9 a project per month. 27 comments later, still no number.

🐼 $5,173 ALL TIME, $150 OF MRR

Thomas van Welsenes launched Launch Panda in April, a guided roadmap for submitting a tool to Product Hunt, Uneed and Peerlist. His Stripe-verified page puts that all-time figure against exactly one active subscription, because the money comes from a $24 lifetime plan, a $129 per-launch fee and sponsor slots. He credits the sponsor slots for last month’s jump.

STACK OF THE DAY

Sesame - A local-first password and 2FA vault where nothing reaches the vendor’s servers. The desktop client is AGPL-3.0, free during beta, Windows only so far. There’s no finished audit, one HN commenter counted 881 dependencies, and the site itself tells you to load test data instead of real secrets.

Not sponsored. We just feature tools builders would actually use.

BOOKMARKED TODAY

Curated by AI, built by a human.