Mistral released a trillion-parameter model it says could help real attackers. The copies already downloaded will never get the fix.

Mistral AI, the Paris company that raised €3 billion in September, released the weights of Mistral Large 4 on 29 October, three weeks after the model went into public preview on its API. Anyone can now download and run it. In the same announcement, Mistral said that its monitoring of preview traffic showed “a potential for uplift to conduct real attacks”, and that it is changing the model’s guardrails in response. Those changes will reach Mistral’s own API and future releases. They will not reach the copies that are already out, as Mistral’s vice president of science, Pierre Stock, confirmed to CSO Online.

That is the trade at the centre of open-weight AI, stated more plainly than most labs ever state it.

How big Mistral Large 4 is and what it costs

Mistral Large 4 is a mixture-of-experts model with 1.05 trillion parameters, of which about 52 billion are active for each token, a 1.6 billion parameter vision encoder and a context window of one million tokens, according to Mistral’s model documentation. Mistral says it was trained from scratch in its own European data centres and is served from the same infrastructure, VKTR reports, and that it handles more than 160 languages, Danish among them.

The licence is a modified MIT licence. Companies can use, modify, fine-tune and sell products built on it. Anyone who wants to offer the model itself as a hosted service needs a separate commercial licence from Mistral. On Mistral’s API it costs $0.70 per million input tokens and $2.10 per million output tokens.

It is not the strongest open model. Mistral claims the top open-weight score on agentic coding, and TechCrunch reports Mistral’s claim that it matches China’s GLM-5.3 while using 47% fewer tokens per task. On Artificial Analysis’s broader intelligence index it scores 26, against 32 for both GLM-5.3 and DeepSeek V4.1 Flash, according to Xenospectrum. The technical report behind Mistral’s own numbers has not been published.

What Mistral says the model can do for attackers

Mistral is selling Large 4 as a cyber defence tool, and the same skills cut both ways. On the Artificial Analysis Cyber Index, which tests whether a model can find, reproduce and patch software vulnerabilities, it scores 51%. Mistral’s own chart puts two open models, DeepSeek V4.1 Flash and Xiaomi’s MiMo-V2.6-Pro, above it.

The safeguards look good on paper. Mistral says the model refused 96.6% of malicious cyber requests across three public test suites, the best rate it has measured for an open model, and that during the preview it refused black-box attacks on live targets. Niyati Daftary, a principal analyst at Gartner, told CSO Online that the figure should be read narrowly, because it describes Mistral’s test prompts and not a motivated attacker.

That caution is right, and it understates the problem. Refusal behaviour in open weights is only a default, and anyone with the hardware can fine-tune it away. The UK’s AI Security Institute made the same point in July, when it found that the best open models now trail the closed frontier on cyber tasks by four to seven months, and called open release a “persistent and irreversible risk of misuse”. Mistral has kept a specialised penetration-testing variant back for vetted partners such as Orange Cyberdefense. The general model is already public.

Why releasing it anyway is a defensible bet

There is a serious case for what Mistral did, and Stock made it. Attackers already have capable open models from China, and defenders who cannot use a model because a vendor refuses security work, or can cut off access, are worse off. Stock told TechCrunch that open weights give access “that can’t be cut off by definition”. Mistral says ENISA, the EU’s cybersecurity agency, is testing Large 4 for finding vulnerabilities, auditing code and analysing defensive logs.

The defensive gains are real. We have written about how quickly AI tools are finding serious holes, and about Anthropic keeping Mythos from the public because it was too good at it. A European company that wants a model to scan its own code, inside its own network, under European law, now has one from a European vendor.

Where Mistral is weaker is on paperwork. Under the EU AI Act, models trained with more than 10^25 FLOPs are presumed to carry systemic risk, which means formal risk assessment, incident reporting and cybersecurity duties. Stock told CSO Online that Mistral is a full signatory of the general-purpose AI code of practice, including its safety and security chapter, but did not say whether Large 4 has been classified as a systemic-risk model or what assessment came before release. For a model whose maker says it could help real attackers, that is the question the AI Office should be asking.

What European businesses should weigh before running it

Self-hosting makes the safety work yours. Charlie Dai, an analyst at Forrester, told CSO Online that open weights shift guardrails, access control, monitoring and misuse prevention to the operator. When Mistral improves the safeguards next month, a copy running on your servers stays as it is unless you replace it.

So decide which copy you need. The hosted API gets Mistral’s safeguard updates and is still European. A self-hosted deployment gives you control over where data goes, which matters under GDPR and for regulated sectors, and makes you responsible for patching the model like any other software. Mistral names ABN AMRO, Crédit Agricole and ASML among the companies working with the model, so this is not an exotic route.

Budget for the hardware honestly. Xenospectrum reports that the validated configurations use eight Nvidia B300 GPUs at FP8 precision. That is a data-centre purchase, or a rental from a cloud provider, and most Danish companies will end up on Mistral’s API or on Microsoft Foundry, which was the first cloud to offer it.

Run it as a component, not as an unsupervised agent. Daftary’s advice to CSO Online is to isolate it, give it the least access that works, sandbox any code it writes and keep a human sign-off before any fix is applied. That applies to every model you let near your systems, and it is the lesson from Cohere’s finding that an Alibaba model tried to upload a file to Beijing: downloaded weights are untrusted software until you have watched what they do.

And keep the comparison fair. For most companies that want to self-host, the realistic alternative to Mistral is an open Chinese model with a similar risk profile, a less transparent maker and, on Mistral’s own chart, a lower refusal rate. If your security team has to own an open model’s behaviour either way, owning one trained in Europe by a company subject to the AI Act is the easier position to defend.