Mistral’s release post for the Large 4 weights contains a sentence most launch coverage skipped. After watching the preview’s live cybersecurity traffic, the company wrote that “we see a potential for uplift to conduct real attacks”, and said it is updating its guardrails in response. The same post, published October 29, put the full weights on Hugging Face with no access gate.
Both of those things are true at once, and the gap between them is the story. A guardrail update reaches the copy of Mistral Large 4 that Mistral serves. It does not reach the copy you downloaded on Thursday. That is not a flaw in the release. It is the release. The property Mistral is selling, a model nobody can take away from you, is the same property that makes you the only party who can patch it.
What actually shipped on October 29
The model itself was announced on October 6 as a public API preview. What landed this week is the part that justified the “open” label: two checkpoints on Hugging Face, an FP8 build and an NVFP4 build for Blackwell GPUs, under what Mistral calls the Mistral Ecosystem Open-Weight License. The model card describes a mixture-of-experts design with about 1 trillion total parameters, roughly 49B active per token (52B once embeddings and output layers are counted), a 1M-token context window, and text plus image input.
Mistral’s own numbers, all vendor-reported, from the release post:
- Terminal-Bench 4.0 rose to 41%, up 13 points from the 28% preview, on 30% fewer output tokens.
- The Artificial Analysis Coding Agent Index sits at 48%, roughly tied with GLM-5.3 while using 47% fewer tokens per task.
- The Artificial Analysis Cyber Index lands at 51%, with a 96.6% average refusal rate on malicious cyber requests, which Mistral says is the highest it measured among open models.
- API pricing is $0.70 per million input tokens, $0.07 cached and $2.10 output.
The Next Web adds the comparison set: DeepSeek V4.1 Flash at 31% on Terminal-Bench 4.0 and GLM-5.3 at 40%, plus a CyberGym-E2E score of 79% for Large 4. It also reports that the quantized version runs on four Nvidia B200 or B300 GPUs, and that Mistral credits three extra weeks of reinforcement learning for the jump since the preview.
Read those numbers with the right frame. On the Artificial Analysis Intelligence Index, the preview scored 38 and placed 18th of 25, tied with GPT-6 Luna and well behind Claude Opus 5.5 at 58; Chinese open models such as MiMo-V2.6-Pro (46) and GLM-5.3 (45) were ahead too. The final model card itself concedes that leading Chinese open-weight models score higher on the aggregate. Large 4 is the strongest open model built outside China, and competitive with the best Chinese one on agentic coding. It is not a frontier leader, and Mistral is not claiming it is. Our usual caveat applies: a benchmark is a hypothesis about your workload until you run your own tasks.
Two answers to the same cyber question, one week apart
The timing is what makes this release worth more than a spec sheet. On October 28, Google announced Gemini 4 Carbon and gave it to a vetted set of cyber defenders with no general availability date. A day later, Mistral put a model with a top-tier cyber score on Hugging Face for anyone with the storage to pull it.
Mistral frames that contrast as the point. Pierre Stock, its vice president of science, told TechCrunch that open weights mean access “can’t be cut off by definition,” and told The Next Web that “AI is going to be like electricity,” something no company should rely on a provider to switch off “from one day to another.” Some customers already point Large 4 agents at their own applications for automated penetration testing.
Then look at what Mistral did with its own most capable cyber build. The release post says enterprise design partners, Orange Cyberdefense among them, get preview access to “a specialized variant” aimed at penetration testing, vulnerability assessment and red-teaming, behind vetting, contracts, and testing limited to systems the partner owns or is explicitly authorized to test. That is a gated tier. It is smaller and less formal than Google’s Fairwind program for Carbon, but it is the same instinct. The open lab and the closed lab drew the line in different places; both drew one.
So the useful reading is not “Google locks it down, Mistral sets it free.” It is that every lab now runs two products: a general model whose guardrails are a matter of training, and a specialist tier whose guardrails are a matter of contracts. What changed on October 29 is that the general tier of a strong cyber model is now a file. We made a similar argument about what Moonshot’s cyber data scrub on Kimi K3.1 Pro actually buys: the open ceiling moves, and the floor was already set by older models anyone can run.
The guardrail you can’t receive
Here is the operational consequence nobody selling “sovereign AI” puts on a slide.
When you call Large 4 through the Mistral API, Microsoft Foundry or NVIDIA’s hosted endpoints, Mistral (or its distribution partner) sits between your request and the model, and the guardrail update it promised lands without you doing anything. When you run the weights on your own GPUs, the guardrails are whatever was trained into the checkpoint you pulled, plus whatever you put in front of it. Mistral’s post says the model distinguishes defensive from malicious cyber tasks out of the box. It does not say how future guardrail changes reach self-hosted copies, and the only mechanism that could is a new checkpoint you choose to download, test and roll out.
That is a patch-management problem, and it is a familiar one. I have spent more than twenty years in IT operations at a large telecom, and the part of sovereign AI infrastructure that looks least like a model problem is exactly this one. A hosted service hides a whole department’s worth of work: watching for vendor advisories, staging a new build, regression-testing it against what you already run, scheduling the change, keeping the old version ready for rollback. Bring the model in-house and that department is now yours. We would never accept a firewall appliance that shipped with no update channel and a vendor note saying the rules “may need changes.” A downloaded model with known uplift potential is in the same category, and it needs the same change control: an owner, a watch on the vendor’s release notes, an eval suite that runs against every new checkpoint before it reaches production, and a decision record for each version you choose not to adopt.
The second thing a telecom or managed-service provider should read twice is the license. Using the weights internally is free. But the license text says that if you or an affiliate operate a Model as a Service business, you need a separate commercial license from Mistral before commercial use. It defines that business as giving a third party access for inference or post-training in a way that lets them exercise meaningful control over inputs, parameters or training data, and it carves out end-user products where the model is embedded in specific features and the simple relaying of requests to models hosted by others. There are no revenue or user thresholds. A carrier that builds a “sovereign AI” endpoint for business customers is the exact case the clause targets, and as one analysis notes, “meaningful control” has no case law yet. Price the commercial license before you price the GPUs.
What a buyer should do with this release
Large 4 is the most credible option to date for an organization that needs a model it controls, from a vendor outside the US and China, with a license it can read in five minutes. That is a real market, and it was thin until this week. The question is which route you take to it, because each one moves a different responsibility onto your side of the line.
| Route | Who applies guardrail updates | License position | What you take on |
|---|---|---|---|
| Mistral API or Mistral Studio | Mistral | Covered by Mistral’s own products | Vendor dependency, data handling terms |
| Microsoft Foundry or NVIDIA endpoints | Mistral and the platform | Covered by the distribution agreement | Cloud region choice, platform terms |
| Self-hosted weights, internal use only | You, by adopting new checkpoints | Free under the open-weight license | GPUs, serving, patch cadence, your own guardrail layer |
| Self-hosted weights offered to customers | You | Separate commercial license required | All of the above, plus a contract with Mistral |
The table is our characterization of the release post and license, not a matrix Mistral published.
If you are evaluating it this quarter, three steps keep the decision honest:
- Run the API first, on your tasks. At $0.70 input and $2.10 output, a few hundred representative tasks cost little, and Mistral’s own claim that token efficiency matters more than the per-token rate is testable by measuring cost per completed task. The GPU math we ran for Meta’s Muse Spark Open applies here in spirit: four Blackwell GPUs is a capital line, not a weekend project.
- Decide who owns the checkpoint before you download one. Name the person who watches Mistral’s release notes, the eval suite that gates a new version, and the rollback plan. If nobody owns it, stay on the hosted route, where Mistral owns it.
- Put your own controls in front of the model. A self-hosted model’s refusals are a default, not a policy. Log every request and response outside the serving stack, restrict which tools and networks an agent built on it can reach (our notes on sandbox network boundaries apply directly), and treat cyber-adjacent prompts as a monitored category rather than trusting the trained refusal rate.
Mistral has a point that access which can be cut off is not sovereignty. The trade it doesn’t advertise is that a model nobody can recall is also a model nobody else will maintain for you. The weights became yours on Thursday. So did the job of keeping them safe.