Mistral releases weights for Le Chonk, a trillion-parameter open model aimed at cyber defenders
Anyone can now download and self-host Mistral Large 4. Mistral says it leads open models at coding and cyber defense, and admits attack risks.
The skim
- Mistral released the weights for Mistral Large 4, nicknamed "Le Chonk," on Thursday. It's a trillion-parameter model that anyone can download from Hugging Face and run on their own servers.
- Mistral is pitching it at cyber defenders. It says the model scores 51% on the Artificial Analysis Cyber Index and that in its tests it refused 96.6% of malicious cyber requests.
- Mistral also says it saw "a potential for uplift to conduct real attacks" during the preview and is tightening its guardrails. A more aggressive pen-testing version stays restricted to vetted partners.
What Mistral released
The French lab first showed Mistral Large 4 in a public preview on Oct. 6. On Thursday it published the weights of an improved version, after what it says were three more weeks of reinforcement learning. According to Hugging Face, it's a mixture-of-experts model with about 1 trillion total parameters, roughly 49 billion of them active for each token, a 1 million-token context window, and text and image input.
The license is a modified MIT license. The model is free to use, modify, fine-tune and sell products on, with one catch: companies that offer it as a hosted model service need a separate commercial license from Mistral. Through Mistral's own API, it costs $0.70 per million input tokens and $2.10 per million output tokens. Microsoft Foundry is the first cloud to carry it, and Nvidia offers it as a NIM container.
On coding, Mistral says the model scores 48% on Artificial Analysis's Coding Agent Index, effectively tied with China's GLM-5.3, the top open model there, while using 47% fewer tokens per task. It reports 41% on Terminal-Bench 4.0, up 13 points from the preview. Hugging Face says the model also scored 82% on a vulnerability reproduce-and-patch test, and 93% on Cybench, a set of 40 challenges drawn from security competitions. These are the company's and its partners' numbers, not independent tests.
Why it matters
The strongest AI models for security work have mostly stayed locked up. Google's Gemini 4 Carbon, announced Wednesday, is available only to selected defenders for now. Mistral is going the other way. "Access that can't be cut off by definition because the model is open-weighted," Pierre Stock, Mistral's VP of science, told TechCrunch. For governments and banks that can't send code or logs to a U.S. API, that's the pitch. Booz Allen, CrowdStrike, Elastic and Europe's cybersecurity agency ENISA said they've been testing it, and Cisco and Cloudflare backed the open approach in Mistral's announcement.
The trade-off is that open weights can't be recalled. Anyone can download them, and a determined user can try to fine-tune the refusals away. Mistral is unusually direct about the risk. It says it monitored cyber-related use of the model during the preview, and "we see a potential for uplift to conduct real attacks." A specialized variant built for penetration testing and red-teaming goes only to vetted partners such as Orange Cyberdefense, under contract.
What's next
Mistral says a full technical report is "coming soon," and that customers can tune Large 4 into smaller, task-specific variants for well-defined security jobs. Researchers can now test the security claims themselves. That includes how easily the guardrails come off, which may matter as much as the benchmark scores.
Sources: Mistral, Hugging Face and TechCrunch.
