Mistral Large 4 Is Out — Open Weights, New Licence and a Cyber Edge

By Muzamil Ahmad · Updated 2026-10-30 · Coding

#coding#mistral large 4#mistral large 4 guide#le chonk#open weights ai model#mistral ecosystem licence#ai cybersecurity model

Save

How we write our guides: we start from the vendor’s own announcement or documentation, not from other “best of” lists. Launch dates and features are checked against that primary source; anything reported only by coverage is labelled as reported. Prices and allowances are given only when the vendor publishes them — otherwise we say “not published” rather than guessing. We do not invent test results, prices, or rankings. Our guides are drafted with AI assistance, then reviewed and edited before publication; the final call on what we recommend is a human one.

The wait is over. On Thursday, October 29, Mistral AI publicly released the open weights for Mistral Large 4 — the trillion-parameter model nicknamed "Le Chonk" — and anyone can now download it from Hugging Face and run it on their own hardware. When we published our preview of Mistral Large 4, the weights had not landed, so we set five checks to run the day they did. This guide is the follow-up: the checks, answered with the real facts.

One disclosure before anything else. We have not downloaded or run this model ourselves — at roughly a trillion parameters, that is a serious hardware commitment, and we will not pretend otherwise. Everything below is built from Mistral's and Hugging Face's published documentation plus independent wire reporting from Reuters. Every benchmark figure is vendor-reported unless we say otherwise, and you should read them that way.

So, the five checks in brief. Did it actually ship, and when? Yes — October 29, on Hugging Face, after Reuters had pointed at October 27 and the model page had hinted at October 31. What licence? Not Apache 2.0, as Large 3 was. Large 4 ships under a new Mistral Ecosystem Open-Weight License, an MIT derivative with real limits on hosted-service use. Are the benchmarks strong? On paper, yes — especially in cybersecurity — but they are Mistral's numbers, not independent tests. What about safety? The positioning is defensive, and the model reportedly refuses harmful cyber prompts more than any other open-weight model. Can ordinary people run it? Mostly no — this is data-centre and extreme-workstation territory. The rest of this guide unpacks each answer.

What Actually Shipped

The model card lives at mistralai/Mistral-Large-4-1T-A52B on Hugging Face, inside the Mistral Large 4 collection. Large 4 is a multimodal, multilingual mixture-of-experts model: it reads text and images, works across many languages, and activates only a slice of its parameters for each token, which is how a model this large stays economically plausible at all.

Two official quantised variants ship alongside the main checkpoint: an FP8 version and an NVFP4 version, the latter aimed at NVIDIA's Blackwell hardware. The community moved fast, as it always does — Unsloth and the llama.cpp team published GGUF builds on day one, in quants ranging from tiny IQ2_XXS and Q2_K files up through Q4_K_M, Q8_0 and full BF16, plus an NVFP4 GGUF. Inference support landed everywhere at once: transformers, vLLM and llama.cpp all work from day zero, and fine-tuning through TRL was demonstrated the same day.

The dates deserve one sentence, because our preview tracked them closely: Mistral announced Large 4 on October 6 in Abu Dhabi with an API preview, Reuters reported an October 27 release, the Hugging Face page later estimated October 31 — and the weights actually landed October 29. Close to the reports, confirmed by neither. That is exactly why we waited for the files themselves before writing this guide.

The Licence, in Plain English

This is the section most coverage will skip, and it is the one that matters most if you build products. Large 3 was Apache 2.0 — about as permissive as licences get. Large 4 is not. It ships under the Mistral Ecosystem Open-Weight License, which Hugging Face describes as an MIT derivative that establishes limitations for model-as-a-service offerings.

Here is what that means in practice. Downloading the weights is allowed. Running the model on your own infrastructure is allowed. Modifying it and fine-tuning it for your own work sits within the open-weights spirit of the licence. The restriction bites at a specific point: wrapping the model up and selling access to it as a hosted service — model-as-a-service — is limited by the licence terms. If your business plan is "download Large 4, put an API in front of it, charge strangers per token," you are exactly the reader who must read the full licence text before writing a line of code.

Why would Mistral tighten the terms after giving Large 3 away under Apache? The honest reading is competitive: permissive licences let large cloud providers resell a lab's own model back to the market, and mid-sized labs have decided they would rather keep the weights open for users while reserving the hosted-service layer for themselves and their partners. You can agree or disagree with that trade, but you should not be surprised by it — and you should not assume "open weights" still means "no strings." It no longer does, here or at several other labs. If you are comparing open models for a coding stack, our roundup of the best AI coding assistants covers the hosted alternatives too.

The Cyber Story: Built for Defenders

Reuters framed the release around cybersecurity, and the documentation backs that framing: Large 4 is positioned for organisations that need to find and fix vulnerabilities in their own systems. The headline number is the Artificial Analysis Cyber Index reproduce-and-patch test: give the model a real, known vulnerability and ask it to reproduce the flaw and write a working patch. Large 4 reportedly scores 82%, the highest result reported — and here is the detail that makes the number interesting rather than just big. Closed frontier models score near zero on this test, not because they cannot do the work, but because their safety filters refuse: reproducing a vulnerability looks, to a filter, exactly like attacking one.

That is the core argument for open weights in security work. A security team's legitimate job — reproducing an exploit in a sandbox, analysing malware, prioritising which vulnerabilities to patch first, drafting detection rules — routinely resembles offensive hacking. An API provider's filter cannot tell the difference mid-incident, and it will block you at the worst possible moment. With open weights, the usage policy and the deployment sit under your own team's control. Mistral says its internal teams already use the model for malware analysis, vulnerability prioritisation and detection-rule writing.

The supporting numbers, all vendor-reported: 93% on Cybench's 40 competition challenges, a top-five global position on the Cyber Index overall, and 93.3% attack resistance on Lakera's B3 prompt-injection benchmark — meaning the model is hard to trick into ignoring its instructions.

Then there is the paradox, which is actually reassuring. On benchmarks of harmful cyber prompts — JailbreakBench, StrongREJECT, AgentHarm — Large 4 reportedly has the highest average refusal rate of any open-weight model. A model built for security work that also refuses malicious requests more than its peers is not a contradiction; it is the product. The openness gives defenders control; the training keeps the refusals pointed at genuinely harmful requests rather than at defensive work that merely looks dangerous. Whether that balance survives contact with real-world misuse is a fair question — but as a design intention, it is coherent, and it distinguishes Large 4 from "uncensored" releases that treat refusal itself as a defect.

Benchmarks: What the Numbers Do and Don't Prove

Beyond cyber, Mistral reports a strong set of coding and agent results. Treat the table below correctly: every score in it comes from Mistral or Hugging Face's launch material. None of it has been independently reproduced yet, launch benchmarks are run under conditions the vendor chooses, and real-world performance on your codebase is the only test that ultimately counts. What the numbers do establish is intent and rough tier — Large 4 is plainly aimed at the top of the open-weights class, alongside releases like Kimi K3.1 Pro and DeepSeek V4.1 Flash, rather than at the small local-model niche.

Two more figures round out the picture. On SWE-Atlas-QnA, a question-answering benchmark over real codebases, the model scores 59.4%, and on AA-Briefcase, an agentic work benchmark, it posts 1,393 Elo. Hugging Face also notes the Coding Agent Index score sits ahead of DeepSeek V4 Pro and Qwen3.8 Max — vendor-chosen comparisons, again, but consistent with the overall picture.

The one ranking here that is not Mistral's own: Artificial Analysis places Large 4 fifth among open-weights models on its Intelligence Index as of October 29. Artificial Analysis is an independent evaluator, so that placement carries different weight from the launch table. Fifth-best open model in the world, on the day of release, with the strongest reported cyber scores in its class — that is the fair summary. What it is not is proof that Large 4 beats any specific rival on your tasks, and anyone who reads a launch table as a league table of guaranteed outcomes is reading marketing, not measurement.

Under the Hood, Briefly

You do not need the architecture to use the model, but three choices explain its behaviour. First, the expert routing: Large 4 has 128 experts per layer, and for each token a router activates just four of them, plus one shared expert that always runs — five experts per token, which is how 49 billion active parameters come out of a trillion-parameter model. The first of its 72 layers is dense; the remaining 71 are mixture-of-experts layers.

Second, attention. The model uses multi-head latent attention, which compresses the key-value cache so long contexts stay affordable, combined with a sparse-attention indexer that selects up to 2,048 relevant key positions per query — the mechanism that makes a 1-million-token context window practical rather than theoretical. Its positional encoding, LeRope, applies YaRN scaling for the same reason. The vision side is a 1.6-billion-parameter Pixtral encoder with 30 layers, so image understanding is a first-class input, not a bolt-on.

Third, reasoning. Large 4 is a reasoning model with three effort settings — low, medium, high — and the default is high. Notably, reasoning cannot be disabled entirely. For agent and security work that is mostly a feature; for simple, latency-sensitive tasks it means you are always paying some thinking cost, and your integration should budget for it.

How to Run It

There are three realistic paths, and choosing between them is really a hardware question.

Transformers is the reference route: Hugging Face documents loading the model with AutoModelForMultimodalLM, which suits research, evaluation and fine-tuning. Fine-tuning through TRL works from day one; Mistral's example ran on a node of eight B300 accelerators, which tells you the scale involved.

vLLM is the serving route for teams deploying on GPU clusters. The NVFP4 variant needs NVIDIA Blackwell hardware, and a DSpark drafter is available for speculative decoding. This is the path for the licence's intended audience: organisations running the model on infrastructure they control.

llama.cpp and the Llama App are the local route, via the GGUF builds — with a large asterisk. The most striking data point in the launch material is a 2-bit Q2_K GGUF running on a single Mac Studio-class M3 Ultra with 512GB of unified memory, at roughly 90 tokens per second of prefill and about 15 tokens per second of generation. Read that again: the "runs on one machine" demo requires half a terabyte of RAM and the most aggressive compression on the menu, and still generates at reading speed rather than chat speed. Everything above that — Q4_K_M, Q8_0, BF16, the official FP8 and NVFP4 builds — needs distributed or multi-GPU setups.

The fourth route is the honest recommendation for most readers: don't run it yourself. Hugging Face Inference Endpoints and Inference Providers offer hosted access to the model, and Mistral's own API remains the simplest path of all. You give up the control that makes open weights valuable for security work, but you also give up the half-terabyte problem. If you are weighing hosted frontier models against each other for everyday use, our ChatGPT vs Claude vs Gemini comparison covers that side of the fence.

A Worked Example

The following scenario is fictional, written to show the workflow — it is not a real incident or a real customer.

Imagine a four-person security team at a small software company. A scanner flags a known CVE in an open-source library their product depends on. The team loads Large 4 on their own infrastructure — the code involved is sensitive, and they do not want it leaving the building.

Step one: they give the model the CVE description and the vulnerable code, and ask it to reproduce the flaw in a sandboxed copy of the library. Because the weights are theirs to run, no external filter interrupts a request that looks like an attack. Step two: with the reproduction confirmed, they ask for a patch, and the model drafts a fix targeted at the exact code path the exploit uses. Step three: they run their existing test suite against the patched version, and ask the model to explain, in plain language, why the patch closes the hole without changing the library's behaviour elsewhere — an explanation the team reviews before anything ships. Step four: the lead writes up the incident for the company's records, using the model's summary as a draft, not as gospel.

Nobody in this story did anything a good closed model could not do on a cooperative day. The difference is control: the sensitive code never left their network, and no third-party filter got a vote on whether defensive work was allowed to proceed.

The Honest Limits

Start with the obvious: the benchmarks are unverified. Everything impressive in the tables above comes from the launch material. Independent replication will take weeks, and launch numbers have a long history of softening under third-party testing. The Artificial Analysis placement is a good sign, not a verdict.

Second, the size is the story and the problem. A trillion parameters excludes almost everyone from running the full model locally, and even the 2-bit path demands hardware almost nobody owns. For most individuals, "open weights" here means "open to inspect and to host at serious cost," not "free ChatGPT on your laptop."

Third, reasoning cannot be switched off. Defaulting to high effort is right for hard agent work, but it taxes every interaction, and teams building high-volume, low-difficulty pipelines will feel it.

Fourth, the licence's model-as-a-service clause is a genuine constraint, not fine print to wave through. Commercial plans need a careful read, and anyone burned by a licence change before will recognise the pattern.

Finally, it is day one. Quant quality varies, serving stacks have rough edges, and the ecosystem of tools, fine-tunes and community knowledge that makes an open model genuinely useful takes months to accumulate.

Verdict

Download it today if you are a security team that needs defensive cyber work done under your own control, an organisation with Blackwell-class or serious GPU infrastructure and a reason to self-host, or a researcher who wants to study how a frontier-scale open model is actually put together.

Wait if you are an individual developer curious about local models — watch the quantisation scene, the independent benchmarks and the distilled successors instead — or if your commercial plan depends on reselling hosted access, in which case the licence question comes before the download, not after.

Stay on API or closed models if your work never trips safety filters, you have no compliance reason to self-host, and your real constraint is convenience. A hosted frontier model that simply works will beat a trillion parameters you cannot house. Large 4's release matters most to the people the API model serves worst — defenders whose work looks like attacks — and for them, October 29 was a genuinely good day.

Sources

• Hugging Face, "Welcome Le Chonk: Mistral Large 4 on Hugging Face" — specifications, variants, GGUF builds, benchmarks and licence summary: https://huggingface.co/blog/mistral-large4
• Mistral Large 4 model repository on Hugging Face: https://huggingface.co/mistralai/Mistral-Large-4-1T-A52B
• Reuters, "Mistral AI publicly releases Large 4, targets cybersecurity users" (October 29, 2026) — release confirmation and positioning: https://www.reuters.com/legal/litigation/mistral-ai-publicly-releases-large-4-targets-cybersecurity-users-2026-10-29/
• Mistral AI: https://mistral.ai