Mistral’s Le Chonk Turns Cyber Defense Into a Download, but the Independent Index It Cites Ranks It Seventh, and Its One First Place Among Open Models Is Won by a Single Task

On October 29, Mistral released the weights of Mistral Large 4, nicknamed Le Chonk, a model of about one trillion parameters. The model card calls it “state of the art among open-weight models for security work, while refusing malicious requests.” TechCrunch described a trillion-parameter “open source AI model” and said the release is “allowing businesses and governments to download and deploy the system themselves.” WIRED reported that Mistral now calls it the “world’s best” open-weight model for automated coding and cybersecurity, under a headline that says it has “Leapfrogged China in the Open-Weight Race.”

I wanted to see how much of that the public data supports. The independent test Mistral cites for cyber work is Artificial Analysis’s Cyber Index, so I read its leaderboard page at 10:52 UTC on October 30, decoded every model record on it, and set the result beside Mistral’s own chart data, its model card, its license and the Hugging Face launch post. Mistral’s charts are the most careful link in the chain, because they show the two open-weight models that outscore it; the claims grow stronger at each step away from them. What I found:

• On the Cyber Index the released model scores 50.9, which is seventh of 25 models and third among the 14 open-weight entries, behind DeepSeek V4.1 Flash 1017 (56.8) and MiMo-V2.6-Pro (56.1).
• It is first among open-weight entries on only one of the index’s three tests, CyberGym-E2E-AA, where it solved 104 of 131 tasks and the runner-up solved 103. Six models decline at least 98 percent of that test’s tasks and score near zero on it.
• On discovery, the test of finding vulnerabilities in code, it scores 15.0: 16th of 25 and seventh of the 14 open-weight entries.
• Four figures in Hugging Face’s launch post (an 82 percent reproduce-and-patch score, 93.3 percent on B3, 28.3 percent on Terminal-Bench 4 and 59.9 percent on AutomationBench) match the preview’s values, not those of the weights that were released.
• The 96.6 percent refusal rate Mistral advertises belongs to one checkpoint. Mistral says it is modifying its guardrails after seeing a “potential for uplift” in live traffic, and a copy that has already been downloaded cannot receive that update.
• The license requires a commercial license from a licensee “or any of its affiliates” that operates a Model-as-a-Service business, which is not what “open source” or “freely available” suggests.
• The FP8 checkpoint is 1,060.6 GB, and Hugging Face’s own recipes cap context at 131K tokens against the 1M on the model card.

What changed between the preview and the weights

Two checkpoints under one name

Mistral’s announcement says that “earlier this month” it released Mistral Large 4 “in public preview,” and that more reinforcement learning since then produced the model whose weights went out on October 29. Artificial Analysis (AA) lists the two as separate entries: Mistral Large 4 Preview, released October 6 and flagged as not open-weight, and Mistral Large 4 (High), released October 29 and flagged as open-weight. The weights Mistral released on October 29 are the second model. The Hugging Face repository was last modified at 14:51 UTC on October 29, and the revision I read begins f12dabdc.

The numbers that agree

Some figures differ only in how they are counted. The model card says the model has one trillion parameters with 49 billion active per token, or “52 billion including embeddings and output layers.” Mistral’s API documentation lists 52 billion active and 1.05 trillion total, and the repository name says A52B. The FP8 checkpoint is 54 shards totaling 1,060.6 GB, the NVFP4 checkpoint is 610.1 GB, and both were public and ungated when I read the Hub API. The context window of 1,048,576 positions is in config.json. I found no discrepancy in any of these.

How the claims change between Mistral’s page and the headlines

Each row pairs a claim with what the underlying numbers support.

Several claims do hold up. The 51 percent Cyber Index score matches AA’s page, the model declined none of AA’s tasks, the “47% fewer tokens per task” follows from the two points on Mistral’s scatter chart (8.5 million tokens per task against 15.9 million for GLM-5.3, about 47 percent fewer), and the card’s statement that it scores “the highest among western open-weight models” on the Intelligence Index holds on AA’s page, where the other Western open-weight entries (Beam 1.0 and Nemotron 3 Ultra) score lower. The model card is candid about the aggregate index and bolder about security work. The claims that outrun the data are the superlatives on security work and the press versions of them.

What the independent index shows

AA’s Cyber Index is, in its methodology, “an equally weighted average of its three evaluations.” CWE-Bench-AA gives a model 120 held-out tasks in which it audits a real repository and patches what it finds. DeepsecBench-AA asks it to find vulnerabilities in application code, scored against an expert-verified set with an F2 score that weights recall above precision. CyberGym-E2E-AA gives it 131 memory-safety bugs in C and C++ projects: it must write an input that crashes the unpatched build, patch the code, and keep the project’s tests passing. AA’s launch article says the tasks start from source code and that AA does “not ask any model to build a working exploit.” Declined tasks are tracked and, in AA’s words, reported “separately from the score.”

The script below reads the leaderboard page, which ships its data as escaped JSON, and prints where Mistral Large 4 stands. It uses only the standard library.

# aa_cyber.py
"""Read the Artificial Analysis Cyber Index page and show where Mistral Large 4 stands."""
import json
import re
import urllib.request
from datetime import datetime, timezone

URL = "https://artificialanalysis.ai/evaluations/artificial-analysis-cyber-index"
UA = ("Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 "
      "(KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36")

request = urllib.request.Request(URL, headers={"User-Agent": UA, "Accept-Language": "en-US,en;q=0.9"})
page = urllib.request.urlopen(request, timeout=60).read().decode("utf-8", "replace")

# The leaderboard ships inside the page as escaped JSON: un-escape it, then decode every model record.
flight = page.replace('\\"', '"').replace("\\\\", "\\")
decoder = json.JSONDecoder()
models = {}
for hit in re.finditer(r'\{"id":"[0-9a-f-]{36}","slug":"', flight):
    try:
        record, _ = decoder.raw_decode(flight[hit.start():])
    except ValueError:
        continue
    if isinstance(record, dict) and record.get("cyberIndex") is not None:
        models[record["id"]] = record
rows = sorted(models.values(), key=lambda r: -r["cyberIndex"])


def pct(value):
    return f"{value * 100:5.1f}"


print(datetime.now(timezone.utc).strftime("read at %Y-%m-%d %H:%M UTC"))
print(f"{len(rows)} models have a Cyber Index score\n")
print("rank  model                                       open  index    cwe  deepsec  cybergym")
for rank, row in enumerate(rows, 1):
    if rank <= 8 or row["name"].startswith("Mistral Large 4"):
        print(f"{rank:>4}  {row['name'][:42]:42}  {'yes' if row['isOpenWeights'] else 'no':4}  "
              f"{row['cyberIndex']:5.1f}  {pct(row['cweBench'])}  {pct(row['deepsecBench'])}   {pct(row['cybergymE2e'])}")

target = next(r for r in rows if r["name"] == "Mistral Large 4 (High)")
open_rows = [r for r in rows if r["isOpenWeights"]]


def rank_in(pool, key):
    ordered = [r["name"] for r in sorted(pool, key=lambda r: -r[key])]
    return ordered.index(target["name"]) + 1, len(ordered)


print("\nMistral Large 4 (High): place among all models, then among open-weight models")
for label, key in [("Cyber Index", "cyberIndex"), ("CWE-Bench-AA", "cweBench"),
                   ("DeepsecBench-AA", "deepsecBench"), ("CyberGym-E2E-AA", "cybergymE2e")]:
    place_all, n_all = rank_in(rows, key)
    place_open, n_open = rank_in(open_rows, key)
    print(f"  {label:16} {place_all:>2} of {n_all}    {place_open:>2} of {n_open}")

mean = (target["cweBench"] + target["deepsecBench"] + target["cybergymE2e"]) / 3 * 100
print(f"\nequal-weight mean of the three components: {mean:.2f} (page shows {target['cyberIndex']:.2f})")

print("\nopen-weight models on CyberGym-E2E-AA (131 tasks, one run per task)")
for row in sorted(open_rows, key=lambda r: -r["cybergymE2e"])[:4]:
    print(f"  {row['name'][:34]:34} {round(row['cybergymE2e'] * 131):>3} of 131 tasks  {pct(row['cybergymE2e'])}%")

print("\nmodels that decline most CyberGym-E2E-AA tasks")
for row in sorted(rows, key=lambda r: -r["cybergymE2eRefusalRate"]):
    if row["cybergymE2eRefusalRate"] >= 0.5:
        print(f"  {row['name'][:42]:42} {'open' if row['isOpenWeights'] else 'closed':6} "
              f"{row['cybergymE2eRefusalRate'] * 100:4.0f}% declined  (CyberGym score {pct(row['cybergymE2e'])})")

print("\nopen-weight entries ahead of Mistral Large 4 (High) on the Intelligence Index")
for row in sorted(open_rows, key=lambda r: -(r["intelligenceIndex"] or 0)):
    if (row["intelligenceIndex"] or 0) > target["intelligenceIndex"]:
        print(f"  {row['name'][:34]:34} {row['intelligenceIndex']:5.1f}  {row['creator']['name']}")
print(f"  {'Mistral Large 4 (High)':34} {target['intelligenceIndex']:5.1f}  {target['creator']['name']}")

print("\nthe two Mistral Large 4 rows that matter for Hugging Face's numbers")
for name in ("Mistral Large 4 Preview", "Mistral Large 4 (High)"):
    row = next(r for r in rows if r["name"] == name)
    print(f"  {name:24} released {row['releaseDate']}  open weights: {'yes' if row['isOpenWeights'] else 'no':3}  "
          f"CyberGym {pct(row['cybergymE2e'])}  AutomationBench {pct(row['automationBenchPartialScore'])}")

read at 2026-10-30 10:52 UTC
25 models have a Cyber Index score

rank  model                                       open  index    cwe  deepsec  cybergym
   1  GPT-6 Sol (Daybreak Blue, max)              no     68.7   64.7   48.1    93.1
   2  Kimi K3.1 Pro                               no     64.1   60.8   36.7    94.7
   3  DeepSeek V4.1 Flash 1017 (Max)              yes    56.8   69.2   24.9    76.3
   4  Grok 4.7 (Xhigh)                            no     56.4   68.3   26.9    74.0
   5  MiMo-V2.6-Pro                               yes    56.1   63.3   26.2    78.6
   6  GPT-6 Luna (Max)                            no     52.7   56.7   23.5    77.9
   7  Mistral Large 4 (High)                      yes    50.9   58.3   15.0    79.4
   8  GLM-5.3-Flash                               yes    49.9   55.8   19.9    74.0
   9  Mistral Large 4 Preview                     no     49.5   50.8   16.0    81.7
  12  Mistral Large 4 (Medium)                    yes    43.6   50.0    8.9    71.8

Mistral Large 4 (High): place among all models, then among open-weight models
  Cyber Index       7 of 25     3 of 14
  CWE-Bench-AA     10 of 25     4 of 14
  DeepsecBench-AA  16 of 25     7 of 14
  CyberGym-E2E-AA   4 of 25     1 of 14

equal-weight mean of the three components: 50.89 (page shows 50.89)

open-weight models on CyberGym-E2E-AA (131 tasks, one run per task)
  Mistral Large 4 (High)             104 of 131 tasks   79.4%
  MiMo-V2.6-Pro                      103 of 131 tasks   78.6%
  DeepSeek V4.1 Flash 1017 (Max)     100 of 131 tasks   76.3%
  Step 5 Preview                      98 of 131 tasks   74.8%

models that decline most CyberGym-E2E-AA tasks
  GPT-6 Sol (Max)                            closed  100% declined  (CyberGym score   0.0)
  GPT-6 Astra (Max)                          closed  100% declined  (CyberGym score   0.0)
  Qwen3.8 27B (Xhigh)                        open    100% declined  (CyberGym score   0.0)
  Qwen3.8 2.4T A95B                          open    100% declined  (CyberGym score   0.0)
  Claude Fable 5.1 (Max, Default Fallback)   closed   99% declined  (CyberGym score   0.8)
  Claude Opus 5.5 (Max, Default Fallback)    closed   98% declined  (CyberGym score   0.8)
  Gemini 3.8 Flash (High)                    closed   86% declined  (CyberGym score   8.4)

open-weight entries ahead of Mistral Large 4 (High) on the Intelligence Index
  DeepSeek V4.1 Flash 1017 (Max)      32.5  DeepSeek
  GLM-5.3 (Max)                       31.7  Z AI
  MiMo-V2.6-Pro                       29.9  Xiaomi
  Step 5 Preview                      28.5  StepFun
  GLM-5.3-Flash                       27.8  Z AI
  Mistral Large 4 (High)              26.0  Mistral

the two Mistral Large 4 rows that matter for Hugging Face's numbers
  Mistral Large 4 Preview  released 2026-10-06  open weights: no   CyberGym  81.7  AutomationBench  59.9
  Mistral Large 4 (High)   released 2026-10-29  open weights: yes  CyberGym  79.4  AutomationBench  57.8

The leaderboard

The released model’s 50.9 matches the “51%” in Mistral’s post, and the equal-weight mean of its three component scores reproduces the page’s figure. It is seventh of 25 and third among open-weight entries, behind DeepSeek V4.1 Flash 1017 and MiMo-V2.6-Pro. Mistral’s own bar chart shows the same two models at 57 and 56, so the evidence is on Mistral’s page; the text and the cards claim more than the chart does.

Why the one first place is thin

On CyberGym-E2E-AA the released model solved 104 of 131 tasks, MiMo-V2.6-Pro solved 103 and DeepSeek V4.1 Flash 1017 solved 100. The methodology lists one run per task for this test, so a one-task gap does not say which model is better. The preview solved 107, which means the weights Mistral shipped solved three fewer tasks than the model it previewed.

On discovery the picture is different. DeepsecBench-AA scores the released model at 15.0, 16th of 25 and seventh of the 14 open-weight entries, and AA’s launch article says the best model on that test found “only 41% of the expert-verified issues.” A team choosing a model to find bugs should read that column rather than the average.

The test where refusing models score near zero

CyberGym-E2E-AA is also where refusals dominate. AA’s launch article says GPT-6 Astra, GPT-6 Sol, Claude Fable 5.1, Claude Opus 5.5, Qwen3.8 2.4T A95B and Qwen3.8 27B “refuse at least 98% of tasks,” and the page data show those six scoring between 0.0 and 0.8 on it. Two of the six, the Qwen models, are open-weight, so declining is not a closed-model trait.

Hugging Face’s post argues that “closed source filters can block them” and that a team relying on an API “can also lose access in the middle of an incident.” The first row of the leaderboard is a counterexample. GPT-6 Sol (Daybreak Blue, max) scores 68.7 overall and 93.1 percent on this test, with no declined tasks. OpenAI’s help page says Daybreak Blue gives “Reduced refusals on supported mainline models, including GPT-5.5, GPT-5.6 Sol, GPT-6 Sol, and GPT-6 Luna, for verified defensive work in authorized environments,” and AA’s data record that entry’s mitigation status as unmitigated. The strongest result on the board comes from a closed model behind a vetting step.

The numbers in Hugging Face’s post belong to the preview

Mistral embeds the data behind its charts as JSON in the page, so the vendor’s own figures can be read without squinting at bars. This script prints the four charts that matter here.

# mistral_charts.py
"""Print the chart data that Mistral embeds in its Mistral Large 4 announcement."""
import json
import re
import urllib.request

URL = "https://mistral.ai/news/mistral-large-4-oss/"
UA = ("Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 "
      "(KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36")

request = urllib.request.Request(URL, headers={"User-Agent": UA, "Accept-Language": "en-US,en;q=0.9"})
page = urllib.request.urlopen(request, timeout=60).read().decode("utf-8", "replace")

WANTED = ("Cyber Index", "Refusal of harmful cyber requests", "B3 Agent security", "Terminal-Bench 4.0")
for spec in re.findall(r'<script type="application/json" data-chart-spec>(.*?)</script>', page, re.S):
    chart = json.loads(spec)
    title = chart.get("title", "")
    if any(key in title for key in WANTED):
        print(f"== {title}")
        for point in chart["data"]:
            print(f"   {point['label']:34} {point['value']}")

== Artificial Analysis Coding Agent Index - Terminal-Bench 4.0
   ML4 Preview - self reported        28
   Mistral Large 4                    41.4
   Beam 1.0                           3
   Muse Spark Open                    6
   Kimi K3                            21
   DeepSeek V4.1 Flash 1017           31
   GLM-5.3                            40
== Artificial Analysis - Cyber Index
   Mistral Large 4                    50.9
   Beam 1.0                           34
   GLM-5.3                            36
   Kimi K3                            41
   GLM-5.3 Flash                      50
   MiMo-V2.6-Pro                      56
   DeepSeek-V4.1-Flash 1017           57
== Refusal of harmful cyber requests
   Mistral Large 4 Preview            95.3
   Mistral Large 4                    96.6
   DeepSeek-V4-Pro                    50.7
   Gemma-4-31B                        84.1
   GLM-5.3                            87.1
   Kimi K3                            93.6
== B3 Agent security benchmark - Attack resistance
   Mistral Large 4 Preview            93.3
   Mistral Large 4                    97.1
   DeepSeek-V4-Pro                    58.6
   Gemma-4-31B                        82.9
   Kimi K3                            88.1
   GLM-5.3                            93.3

Hugging Face’s launch post carries the recipes and code for deploying the model, and its benchmark paragraph reports figures that match the preview. Here are four of them against Mistral’s chart data and AA’s page:

In each row the figure in Hugging Face’s post matches the preview’s value (after rounding) and not the released model’s. The post’s 49.8 percent Coding Agent Index score matches neither the 48 percent that Mistral’s announcement and the model card give for the released model, and I found no preview value for it. I cannot tell how the numbers reached the post. Mistral’s own card carries the released model’s values, so a reader who compares the two pages sees two sets of numbers under one name.

The refusal claim belongs to one frozen checkpoint

What Mistral measured

Mistral’s announcement says the model achieves “an average refusal rate of 96.6% on malicious cyber requests, the highest we measure among open models,” and its chart caption defines the figure as the “Average refusal on the cyber-related prompts of JailbreakBench, StrongREJECT and AgentHarm.” The post gives no prompt counts and no split by benchmark, the chart’s axis starts at 40, and the post says “a full technical report is coming soon.” The same checkpoint declined none of AA’s tasks on any of the three tests, so on these two sets of prompts it refuses the malicious ones and not the defensive ones. How it tells them apart is not described. Hugging Face’s post names the difficulty: “Vulnerability research and incident response often appear like attacks in model input.”

The refusal chart shows the released model at 96.6, the preview at 95.3, Kimi K3 at 93.6, GLM-5.3 at 87.1, Gemma-4-31B at 84.1 and DeepSeek-V4-Pro at 50.7. The models in the refusal and B3 charts are not the models in the Cyber Index chart:

Only Kimi K3 and GLM-5.3 appear in all three charts, so a reader cannot line up capability and refusal for the two open-weight models that outscore Mistral Large 4 on the Cyber Index. “The highest we measure among open models” can be checked only against the four other models shown.

What a later guardrail update can and cannot reach

The announcement includes this passage: “In the time since the preview, we carefully monitored cybersecurity-related use in our live traffic. Though we observed the model refusing to comply with black-box attacks against live targets, we see a potential for uplift to conduct real attacks. We are modifying our guardrails accordingly, and will continue updating them in the months to come.”

The post does not say whether the modification is in the weights it released, in the filters on Mistral’s API, or in both. The difference matters because a downloaded checkpoint cannot receive an update; an operator has to fetch a new one. Pierre Stock, Mistral’s VP of science, put the other side of it to WIRED: “Once you open source the weights, they’re all over the internet. It’s impossible to cut off access.” Mistral also says it is giving design partners such as Orange Cyberdefense “preview access to a specialized variant of Mistral Large 4 optimized for advanced cybersecurity workflows, including penetration testing, vulnerability assessment, and red-teaming,” and that “Access is subject to rigorous vetting and contractual safeguards.” So the vendor itself keeps a penetration-testing variant behind a gate and releases the general model openly.

How fast stripped copies appear

The research literature and the press agree on what usually happens after a weights release. Arditi and colleagues found that refusal “is mediated by a one-dimensional subspace, across 13 popular open-source chat models up to 72B parameters in size,” and that erasing one direction “prevents it from refusing harmful instructions.” An earlier paper, BadLlama, showed that the safety fine-tuning of Llama 2-Chat 13B could be undone “with less than $200, while retaining its general capabilities.” Neither tested a model near a trillion parameters, so neither says how hard Mistral Large 4 is. WIRED’s October 14 report on a Tech Against Terrorism benchmark says it “now takes less than three days for abliterated versions of newly released open-weight models to be published online,” against “more than 24 days” in 2024, and gives Alibaba’s Qwen 3.8-27B as an example: released August 14, with versions advertised as “abliterated” online “Within 24 hours.”

I counted repositories on the Hugging Face Hub whose names say abliterated for three open-weight models that AA lists, using AA’s release dates. This is a name match, so it includes quantized conversions and derivatives, and I downloaded none of them.

# hub_check.py
"""Check Mistral Large 4 checkpoint sizes and how fast refusal-stripped copies of open models reach the Hub."""
import json
import re
import urllib.parse
import urllib.request
from datetime import date, datetime, timezone

UA = ("Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 "
      "(KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36")


def get_json(url):
    request = urllib.request.Request(url, headers={"User-Agent": UA})
    with urllib.request.urlopen(request, timeout=60) as response:
        return json.load(response)


def repo_files(repo_id):
    info = get_json(f"https://huggingface.co/api/models/{repo_id}?blobs=true")
    return [item.get("size") or 0 for item in info["siblings"]]


print(datetime.now(timezone.utc).strftime("read at %Y-%m-%d %H:%M UTC"))
fp8 = sum(repo_files("mistralai/Mistral-Large-4-1T-A52B")) / 1e9
nvfp4 = sum(repo_files("mistralai/Mistral-Large-4-1T-A52B-NVFP4")) / 1e9
print(f"FP8 checkpoint {fp8:,.1f} GB, NVFP4 checkpoint {nvfp4:,.1f} GB\n")

need = fp8 / 8 / 0.85
print(f"model card recipe (8 GPUs, --gpu-memory-utilization 0.85): {need:.0f} GB per GPU for the weights alone")
for gpu, gb in [("H200", 141), ("B200", 180)]:
    node = 8 * gb
    verdict = "room left" if 0.85 * node > fp8 else "no room"
    print(f"  8 x {gpu} ({gb} GB each, {node:,} GB): weights fill {fp8 / node:.0%}; "
          f"0.85 of the node is {0.85 * node:,.0f} GB -> {verdict}")
print(f"  8 x B200: the NVFP4 weights fill {nvfp4 / 1440:.0%} of the node")
print(f"Hugging Face's recipes cap context at 131,072 of the 1,048,576 tokens on the model card = 1/{1048576 // 131072}\n")

RELEASED = {"GLM-5.3": "2026-08-18", "Kimi-K3": "2026-07-16", "DeepSeek-V4.1-Flash-1017": "2026-10-17"}
print("Hub repositories with 'abliterated' in the name (a name match; includes conversions and derivatives)")
for key, released in RELEASED.items():
    query = urllib.parse.urlencode({"search": f"{key} abliterated", "limit": 100})
    hits = [m for m in get_json(f"https://huggingface.co/api/models?{query}")
            if re.search("abliterat", m["id"], re.I) and key.lower() in m["id"].lower()
            and not (key == "GLM-5.3" and "flash" in m["id"].lower())]
    first = min(m["createdAt"] for m in hits)[:10]
    days = (date.fromisoformat(first) - date.fromisoformat(released)).days
    print(f"  {key:26} {len(hits):>3} repositories; first created {first}, {days} days after the {released} release date")

query = urllib.parse.urlencode({"search": "Mistral-Large-4 abliterated", "limit": 100})
hits = [m for m in get_json(f"https://huggingface.co/api/models?{query}") if re.search("abliterat", m["id"], re.I)]
for m in hits:
    sizes = repo_files(m["id"])
    print(f"  Mistral Large 4: repository created {m['createdAt'][:16]} UTC holds {len(sizes)} file, {sum(sizes) / 1e9:.1f} GB")

Hub repositories with 'abliterated' in the name (a name match; includes conversions and derivatives)
  GLM-5.3                     16 repositories; first created 2026-08-29, 11 days after the 2026-08-18 release date
  Kimi-K3                     12 repositories; first created 2026-07-18, 2 days after the 2026-07-16 release date
  DeepSeek-V4.1-Flash-1017    27 repositories; first created 2026-10-17, 0 days after the 2026-10-17 release date
  Mistral Large 4: repository created 2026-10-30T00:39 UTC holds 1 file, 0.0 GB
  Mistral Large 4: repository created 2026-10-30T00:39 UTC holds 1 file, 0.0 GB

For GLM-5.3, leaving out its separate Flash model, the first such repository appeared 11 days after AA’s release date and there are 16 now. For Kimi K3 it was two days and 12 matches; for DeepSeek V4.1 Flash 1017, the same day and 27 so far. For Mistral Large 4 I found no stripped checkpoint at 10:52 UTC: the two repositories with the name hold one file and no weights, and were created at 00:39 UTC today. A 1,060 GB checkpoint is a much bigger job to modify and upload than a 27-billion-parameter one, so that says little about next week. Rafe Pilling of Sophos told WIRED that “Anything that’s available to download and circulate unfettered has the ability to be abused as well as used for productive purposes.”

Everyone gates; the gate sits in a different place

None of this means closed labs have solved the problem, or that open weights are uniquely risky. OpenAI’s Daybreak puts verification in front of reduced refusals, and its Red tier “Requires separate Red approval, stronger verification, and access controls.” Mistral puts “rigorous vetting and contractual safeguards” in front of a specialized penetration-testing variant and ships the general model openly. The difference is where the gate sits. For a hosted model the refusal policy stays with the vendor and can change tomorrow; for a downloaded one it becomes a property of the file. Our piece on refusal as a vendor setting made the first half of that point, and a weights release is the other half.

The license is not what “open source” or “freely available” suggests

The license file is 2,632 bytes. Section 2 reads: “If the Licensee or any of its affiliates operates a Model as a Service business, the Licensee must enter into a separate commercial license with Mistral before using the Model or its derivative works for any commercial purpose.” It defines Model as a Service as “giving a third party access to the Model or its derivative works for inference or post-training by any means (for instance via API or hosted endpoints), in a manner that allows such third party to exercise meaningful control over the inputs, parameters, or training data.” The definition excludes “end-user products with model capabilities solely embedded within specific features or harnesses” and “mere relaying of requests to models hosted by others.” Section 3 exempts internal use and “any use of the Model accessed through Mistral’s official products.”

Mistral’s announcement summarizes this as “a single condition: businesses that operate a Model-as-a-Service offering must obtain a separate commercial license from Mistral before using the model commercially.” The license text is wider, because it reaches the licensee’s affiliates. Mistral calls the model “open-weight” under “a modified MIT license.” TechCrunch calls it “open source,” and WIRED says it is “freely available for anybody to access.” Anyone can download the files; whether they may use them commercially depends on the reader’s business. This table is my reading of the text, not legal advice:

Mistral’s post lists Microsoft Foundry and NVIDIA-hosted endpoints among the ways to use the model, and the Hugging Face post lists Inference Endpoints. Those are hosted offerings, which the definition names as its own example. Neither post says what license arrangement each host holds.

What running it yourself takes

TechCrunch says that in cybersecurity “organizations want more control over their data and systems,” and Mistral’s post says organizations can “use and improve Mistral Large 4 without depending on Mistral to serve it through an API.” The checkpoint is large. This is the first half of the output of hub_check.py, shown above, which turns file sizes into memory arithmetic:

read at 2026-10-30 10:52 UTC
FP8 checkpoint 1,060.6 GB, NVFP4 checkpoint 610.1 GB

model card recipe (8 GPUs, --gpu-memory-utilization 0.85): 156 GB per GPU for the weights alone
  8 x H200 (141 GB each, 1,128 GB): weights fill 94%; 0.85 of the node is 959 GB -> no room
  8 x B200 (180 GB each, 1,440 GB): weights fill 74%; 0.85 of the node is 1,224 GB -> room left
  8 x B200: the NVFP4 weights fill 42% of the node
Hugging Face's recipes cap context at 131,072 of the 1,048,576 tokens on the model card = 1/8

The model card’s vLLM recipe uses eight GPUs and --gpu-memory-utilization 0.85 and does not set --max-model-len. At that setting the weights alone need 156 GB per GPU, which rules out H200s (141 GB each) and fits B200s (180 GB each, since NVIDIA gives 1,440 GB in total for the eight-GPU DGX B200). Hugging Face’s post nonetheless gives an Inference Endpoints recipe for eight H200 GPUs with the FP8 weights. Those weights fill 94 percent of the node’s memory and leave about 67 GB across eight GPUs for everything else, and the recipe serves 131K tokens of context, an eighth of the window on the model card, and up to 16 requests at a time. Hugging Face reports its measured results: about 65 tokens per second for a single request (120 to 138 when speculative drafts are accepted) and about 480 tokens per second of total generation across 1,000 ShareGPT conversations.

These are arithmetic on file sizes and published memory capacities, not measurements. They ignore the key-value cache, activations and runtime overhead, which only add to the requirement. The point is practical: “download and deploy” means a node of eight high-memory accelerators, and the context a team can use on that node is smaller than the headline number.

Eleven partner statements, one result

Under the heading “Here’s what global leaders in cybersecurity have to say about Mistral Large 4,” the announcement prints eleven statements from Booz Allen, Cisco, Cloudflare, CrowdStrike, Elastic, ENISA, Fortinet, NVIDIA, Orange Cyberdefense, Rubrik and Zscaler. Ten describe openness, control, sovereignty, integrations or testing in progress: Elastic says it has “already evaluated ML4 against real cybersecurity workloads,” and Rubrik says it will “continue rigorous cybersecurity testing,” and neither gives a result. One, from Booz Allen, reports one: “The model was able to match vulnerability detection recall rates against other frontier cyber models with a compelling cost curve.” It refers to “our internal benchmark for source code security analysis,” names no models or scores, and says nothing about precision.

That is a different measurement from AA’s discovery test, where the released model is 16th of 25, so the two do not contradict each other. It does mean the one partner result in the post cannot be checked either way. Booz Allen also published a lab report on frontier models against operational technology, which tested unnamed models; we covered it in an earlier piece.

What this means in practice

If you are choosing a model for security work

Read the three tests separately. For finding bugs, the discovery column is the relevant one and the model sits in the middle of the table. For patching a memory-safety bug from a crash, the reproduce-and-patch column is the relevant one and it is among the top four. AA ran each task once for two of the three tests, so differences of a task or two are noise, and a test on your own repositories with your own harness will tell you more than any leaderboard.

If you plan to run it

Record the revision you download, because the repository changed on launch day. Check the memory arithmetic against your hardware before you order anything, and decide what context length you need, since the recipes stop well short of 1M tokens. Treat refusal as a property of the file you hold, not a control you can rely on once anyone has fine-tuned a copy, and put your own access control and logging around any deployment. Wait for the technical report if refusal behavior matters to your use case.

If you build a product or service on it

Read Section 2 of the license with your corporate structure in front of you, because it names affiliates. If your product lets customers send their own inputs to the model, get a written answer from Mistral on what “meaningful control” means for you.

If you write about it

Open-weight is not open source, and third among open-weight entries on AA’s Cyber Index is a different claim from best open-weight model for cybersecurity. The first is what the data support today.

What I could not check

• The refusal measurement: prompt counts, the split by benchmark and the list of models Mistral measured. The technical report is not out.
• Mistral’s internal tests on malware analysis, vulnerability prioritization and detection rules, which Hugging Face’s post says the model “was not explicitly trained for.” That post’s Cybench figure of 93 percent on 40 challenges and its other coding figures are not on any page I could check.
• What WIRED says Mistral told reporters at a press briefing; I rely on WIRED for that.
• Behavior. I did not run the model, which needs a node of eight high-memory GPUs, and the memory numbers above are arithmetic.
• Stability. AA’s leaderboard is live and the ranks can move, and I do not know what it showed when Hugging Face’s post was written. My parser depends on how the page is built today. The Hub counts are name matches, and the release dates they use are AA’s listing dates, not necessarily the dates the weights were first uploaded.

The bottom line

Mistral shipped real, public weights and a candid set of charts. On the independent index it cites, Mistral Large 4 is a strong open-weight model for reproducing and patching memory-safety bugs, a middling one for finding vulnerabilities (seventh of 14 open-weight entries), and third overall among open-weight entries. The sentences that call it the best open model for cyber work come from the model card, a launch post and two news stories, and each says more than the chart under it.

The more durable questions sit around the benchmark. The refusal rate describes one file that anyone can copy and modify, the license asks more of some businesses than the coverage suggests, and the hardware that “download and deploy” implies is an eight-accelerator node with more than a terabyte of GPU memory. Beam 1.0, the open model from our earlier look at Reflection’s release, appears at the bottom of Mistral’s Cyber Index chart at 34. That piece also found a weights release whose own serving guides stopped at 256K tokens.

Sources and method

The announcement and chart data are from mistral.ai; the model card, license, configuration files and file sizes are from the Hugging Face repository and its API; the launch post is here. Artificial Analysis supplied the leaderboard page, the CyberGym-E2E-AA page, the methodology and the launch article. The press coverage is TechCrunch and WIRED’s two reports linked above. The scripts ran on Python 3.13.14 with only the standard library, on October 30 at 10:52 UTC; the output blocks are what they printed. Rank positions count entries on AA’s page, so two settings of one model count twice, and “open-weight” is AA’s flag for each entry.