Summary: Mistral has released the open weights of Mistral Large 4 (Le Chonk), its 1-trillion-parameter, natively multimodal flagship, following a public preview earlier in October. Three extra weeks of reinforcement learning pushed it to the front of open-weight coding and defensive-security benchmarks while cutting token usage — which matters if you’re running coding agents at scale or need a model you can self-host with full control.
What the release actually changes
The headline for builders is cost-performance, not just raw scores. On the Artificial Analysis Coding Agent Index, Mistral Large 4 scores 48% — effectively tied with GLM-5.3, the previous open-weight leader — while using 47% fewer tokens per task on average. If your agentic coding bill is dominated by token volume, that trade is the story.
It also now leads open-weight models on Terminal-Bench 4.0 at 41%, a 13-point jump from the preview, with 30% fewer output tokens. On Cognition’s private FrontierCode 2.0 benchmark — which tests whether a repository maintainer would actually merge the agent’s change — it posts 19.7%. Human preference data backs this up: in Surge Code blind pairwise evaluations, the model was preferred over GLM-5.3, Kimi K3, and DeepSeek V4.1 Flash, ranking behind only Claude Opus 5.5 among evaluated models.
Three reasoning modes, one cost dial
Mistral replaced the old “None” setting with an explicit Low/Medium/High reasoning control. Low handles simple tasks cheaply, Medium is for everyday work, and High — the default — targets precision-heavy use cases. For product builders, this is a practical knob: you can route cheap requests to Low instead of paying reasoning overhead on every call, without switching models.
Mistral says gains from continued reinforcement learning are still accelerating with no signs of saturation, so the weights released on October 29 are a snapshot of a moving curve.
Defense work without over-refusing
The second pillar is cybersecurity. Mistral Large 4 scores 51% on the Artificial Analysis Cyber Index, which measures discovering vulnerabilities in a codebase, reproducing and validating them, and patching them without breaking existing functionality. Per Mistral’s announcement, it handles these legitimate defensive tasks without unnecessary refusals.
Safety claims are quantified rather than vague: the built-in guardrails distinguish defensive from malicious cyber tasks, and the model averages a 96.6% refusal rate on malicious cyber requests across JailbreakBench, StrongREJECT, and AgentHarm prompts — the highest Mistral measures among open models.
The vendor chorus is unusually concrete here. Booz Allen reports it matched frontier-model vulnerability-detection recall at a compelling cost curve; ENISA says it is testing the model to identify vulnerabilities, audit code, and analyze defensive logs; Elastic, CrowdStrike, Fortinet, Zscaler, Rubrik, Orange Cyberdefense, Cisco, Cloudflare, and NVIDIA all supplied statements. Treat these as partner positioning, but the pattern — security vendors wanting hostable, auditable models — is real signal for where enterprise demand is heading.
Mistral is also candid about limits: monitoring live traffic since the preview, it observed refusals on black-box attacks against live targets but sees potential for uplift to conduct real attacks, and is updating guardrails in the months ahead.
Why sovereign AI keeps coming up
The model was trained from scratch on European infrastructure, which Mistral frames as a lineage advantage for organizations with data-residency requirements. For regulated industries and governments, the pitch is straightforward: open weights plus a documented training lineage means you can own, customize, and audit the model rather than routing data through someone else’s API.
Practical takeaway
If you’re already running open-weight coding agents, the token-efficiency numbers alone justify a benchmark on your own workloads — especially if you’re currently on GLM-5.3. If you’re in security or a regulated European context, the combination of defensive cyber performance, measurable refusal behavior, and self-hostable weights is a rare package. One caveat: the announcement doesn’t specify the license terms in the supplied text, so check the release page before committing to commercial deployment.