Mistral Large 4 was announced on 6 October with a promise: the weights would drop by the end of the month. On 29 October they did. The one-trillion-parameter model — 52 billion active parameters, natively multimodal — is now downloadable from Hugging Face and available through Mistral's API, under a name its own staff seem to prefer: Le Chonk.

The capability claims are competitive but not singular. Mistral puts ML4 in the top five of Artificial Analysis' Cyber Index, leading open-weight models built outside China; 47% fewer tokens per task than GLM-5.3, its nearest open rival; 93% on Cybench's 40 security-competition exercises; a Coding Agent Index score of 49.8%. It was trained from scratch on 3,800 Nvidia Grace Blackwell GPUs in Mistral's own European data centres, on data spanning more than 160 languages, and is the first milestone on a €3 billion Series D.

The argument is what makes the release interesting. On one test in the Cyber Index — reproduce a real vulnerability in open-source software, then patch it — Mistral says ML4 scores 82%, the highest of any model. The reason it wins is not that it is smarter. It is that several leading closed models, including Claude Opus 5.5 and GPT-6 Astra, score near zero on the same test because they refuse the task.

That is the case Mistral is making, and it is a narrower one than "open models are safer". "Provider-level refusals can block legitimate vulnerability research and incident response," the company wrote, "and losing access to a capability mid-incident can itself become a critical security risk." Pierre Stock, Mistral's VP of science, put the distribution point plainly: "Access that can't be cut off by definition because the model is open-weighted." Arthur Mensch's framing was "a tool for empowerment, not dominance".

The counterweight is real, and Mistral knows it. Before release the model was red-teamed with cybersecurity firms, vetted partners and state authorities who were given "reduced moderation and expanded cyber capabilities". In the same week, security firm Irregular reported that it had run the Chinese open-weight model GLM-5.3 through 13 simulated attack scenarios; it completed at least one stage in three of them, and in some cases violated the instructions it was given in order to get there. Downloadable capability does not distinguish between the defender who needs to prove a flaw is real and the attacker who wants to find one first.

Mistral's own safety numbers are respectable on paper: 93.3% resistance on Lakera's B3 benchmark, higher cyber refusal rates on JailbreakBench, StrongREJECT and AgentHarm than any other open-weight model it compared, saturated robustness to indirect prompt injection. Stock's response to rogue-agent incidents was to caution against overreaction — "We don't want to fearmonger people. We think it is a problem that is solvable."

Commercially, the release is already wired into Europe's security industry: Orange Cyberdefense announced the same day that it would build services on an ML4 variant optimised for security work, running on European infrastructure.

Two labs, 48 hours apart, have now given opposite answers to the same question. Google is handing frontier cyber capability to a vetted list and nobody else until its guardrails are ready; Mistral is handing it to anyone who can pull the weights. Both call their choice the safe one. Neither has published independent evidence that it is.

The practical consequence lands on security teams first. A bank, a hospital network or a ministry can now run frontier-grade vulnerability analysis on hardware it controls, with no vendor able to revoke access during an incident — and with nobody but itself to answer for how that capability is aimed.

Sources