On October 29, 2026, Mistral AI released the open weights of Mistral Large 4, its flagship model nicknamed "Le Chonk." After a closed preview earlier in October, this 1-trillion-parameter model is now downloadable and self-hostable. For an SMB weighing its AI strategy, this shift toward sovereign open source opens up real options, though not without trade-offs.
In brief
- On October 29, 2026, Mistral AI published the weights of Mistral Large 4 (1 trillion total parameters, 52 billion active) under a Mistral Ecosystem Open-Weight license, a modified version of the MIT license.
- The model is positioned for two audiences: developers (Mistral calls it the best open-weight model for coding) and cybersecurity teams (vulnerability discovery and patching).
- On its own B3 Agent Security Benchmark, Mistral claims 97.1% attack resistance, up from 93.3% during the preview.
- The weights are available on Hugging Face and deployable via vLLM or SGLang; API access remains available too, priced at $0.70 per million input tokens.
- Mistral acknowledges that during the preview it observed a risk of misuse of the model for real attacks, and says it strengthened its safeguards before publishing the weights.
What changed on October 29, 2026
Until now, Mistral Large 4 only existed as an API preview, accessible solely through Mistral Studio. With this release, the company crosses a threshold: the model weights (the trained parameters) are now freely downloadable, just like open-source software. In practice, an organization can run Large 4 on its own servers, without depending on an external API or sending its data to a third party.
This is the largest open-weight release ever made by a European player on a model of this size. Mistral positions it explicitly against Chinese open models (DeepSeek, Z.AI, Alibaba) and American ones (Thinking Machines Lab), with a sovereignty argument: training and hosting entirely carried out in Europe.
Who it's for: coders and "defenders"
Mistral targets two priority use cases with this release.
For developers, the model is positioned as the top-performing open model for agentic coding (autonomous code writing by an AI agent). Mistral cites a 48% score on the Artificial Analysis Coding Agent Index, tied with the Chinese model GLM-5.3, but using 47% fewer tokens, making it cheaper to run.
For cybersecurity teams (the "defenders"), Large 4 is positioned as a tool for discovering and reproducing vulnerabilities, usable in-house without sending sensitive data to a third-party service. Partners such as Orange Cyberdefense are testing a specialized variant of the model, under contract and limited to systems they own or are explicitly authorized to test. Cisco, CrowdStrike, Fortinet and ENISA (the EU's cybersecurity agency) also evaluated the model, according to Mistral.
Read with caution
All the figures above come from Mistral AI's own evaluations, published on its official blog. No independent organization has reproduced these results yet. As with any vendor announcement, third-party benchmarks should be awaited before treating them as final.
A point of caution: the risk of misuse
Mistral does not hide its own model's limitations, which is worth noting. In its announcement post, the company states that during the preview phase it observed that Large 4 correctly refused black-box attacks on real targets, but showed a potential for uplift toward real attack capabilities. Mistral says it strengthened its safeguards accordingly before publishing the open weights.
The model shows an average refusal rate of 96.6% against malicious cybersecurity-related requests, the highest among the open models Mistral tested. The company says it distinguishes legitimate defensive uses (which it refuses less) from offensive ones.
For an SMB, this is a reminder of a simple rule: an open-source, self-hosted model escapes the direct control of its publisher once downloaded. Responsibility for its use, and for the safeguards applied internally, falls on the organization deploying it.
Self-hosting or API: how to choose
Publishing the weights doesn't mean self-hosting is the best option for every SMB. Here are the criteria that typically tip the balance.
| Criterion | Stay on the Mistral API | Self-host Large 4 (open weights) |
|---|---|---|
| Direct cost | Pay-per-use ($0.70 / M input tokens) | No per-token cost, but GPUs and infrastructure to fund |
| Technical skill required | Low (API call) | High (vLLM/SGLang deployment, dedicated GPUs) |
| Data control | Data sent to Mistral (under EU law) | Data never leaves the company's own infrastructure |
| Model updates | Automatic on Mistral's side | Managed in-house (new versions to integrate) |
| Best fit | SMBs without a dedicated infra team, occasional use | Heavily regulated sectors, cybersecurity, high volumes |
For most SMBs, the API remains the simplest choice: no servers to manage, billing proportional to use. Self-hosting becomes worthwhile mainly for companies already equipped with GPU infrastructure, or in sectors where keeping data in-house (healthcare, defense, finance, cybersecurity) justifies the investment.
FAQ
Is Mistral Large 4 free?
The weights are freely downloadable under the Mistral Ecosystem Open-Weight license, a modified MIT license that allows use, modification and commercialization. However, a company that resells access to the model as a service (Model-as-a-Service) must obtain a separate commercial license from Mistral.
What's the difference from the October preview?
The October 6, 2026 preview was only accessible through the Mistral Studio API, with no way to download the model. The October 29 release adds the open weights (downloadable on Hugging Face) and improves scores on several benchmarks, for example Terminal-Bench 4.0, which goes from 28% to 41%.
Does an SMB need to self-host this model?
No, in most cases. The API remains the simplest solution for an SMB without an infrastructure team. Self-hosting is mainly for organizations with strong data-confidentiality constraints or usage volumes that justify the GPU investment.
Is this model reliable for sensitive cybersecurity tasks?
Mistral claims a high rate of attack resistance and works with specialized partners such as Orange Cyberdefense. However, the company acknowledges a risk of misuse for offensive purposes and says it strengthened its safeguards. As with any AI-based cybersecurity tool, usage should remain governed by a clear internal policy.
The arrival of an open model of this size, trained in Europe, confirms a trend: digital sovereignty is becoming as concrete an AI selection criterion as price or performance. To go further on choosing between the AI models available in 2026, see our guide How to Choose Your AI Model or explore more real-world results on the LUWAI Mag Resources page.
