Mistral Large 4 goes open weight — DeepSeek still beats it on cyber

Mistral put the weights of Mistral Large 4 up for download today, three weeks after previewing the trillion-parameter model it nicknamed Le Chonk. Wired's headline calls it a leapfrog over China in the open-weight race, and Mistral's own research post calls it the best open-weight model for coding. The chart inside that same post tells a narrower story: on the cybersecurity index Mistral is showcasing, two Chinese open models score higher.

What actually shipped

The download is real this time. Mistral Large 4 is a mixture-of-experts model with 1 trillion total parameters and 49 billion active per token — 52 billion counting embeddings and output layers — running 128 routed experts with four active plus one shared, a 1M-token context window, and native image input, per the Hugging Face model card. The card also confirms it was trained from scratch on 3,800 Nvidia Grace Blackwell GPUs in Mistral's own European datacenters, and that the checkpoint ships with an embedded DSpark speculative-decoding head plus a separate NVFP4 build for Blackwell serving.

The price is the part enterprises will feel. Mistral cut the API to $0.70 per million input tokens, $0.07 for cached input and $2.10 per million output, according to the release post. At preview in early October it was $1.36 and $4.18 — roughly half, and that was the number we flagged as the open question in our analysis of the preview.

The license is not what "open weight" usually implies. The Mistral Ecosystem Open-Weight License is a modified MIT: free to use, modify, fine-tune and commercialize, with one carve-out — anyone running it as a model-as-a-service business needs a separate paid license from Mistral first. You can own the weights; you cannot resell them as an API without permission.

The benchmark arithmetic

Three weeks of additional reinforcement learning moved the coding numbers a long way. On Cognition's private FrontierCode 2.0, which asks whether a repository maintainer would actually merge the agent's change, Mistral scores 19.7% against 19.3% for DeepSeek V4.1 Flash 1017 and 17.8% for GLM-5.3. On Terminal-Bench 4.0 it went from 28% at preview to 41%, one point ahead of GLM-5.3 at 40% and ten ahead of Kimi K3. On the Artificial Analysis Coding Agent Index it scores 48%, which Mistral describes as effectively tied with GLM-5.3 while using 47% fewer tokens per task.

Those are narrow edges on benchmark picks, and the honesty of the post is that it shows them. Then comes the cyber slide, captioned as Mistral leading open weights: 51% on the Artificial Analysis Cyber Index. The same chart lists Xiaomi's MiMo-V2.6-Pro at 56% and DeepSeek V4.1 Flash 1017 at 57%. Mistral is third among open models on the exact axis its press briefing led with, and the reasoning it offers — that it handles defensive security work "without unnecessary refusals" — is an argument about a different thing.

Independent numbers are thinner than the announcement implies. Artificial Analysis's published page for Mistral Large 4 still scores the preview checkpoint at 25 on its Intelligence Index v5 and calls it "among the least intelligent models" at that price, per Artificial Analysis. That is a general-capability composite, not a coding test, and it has not been re-run on the final weights — but the gap between 25 and the 59 that Gemini 4 Carbon posted on the same index is the distance between a vendor-selected coding chart and a full nine-evaluation suite. The honest summary is that Mistral closed the coding gap and has not shown it closed anything else.

What Mistral is really selling

Read the customer list, not the scoreboard: Booz Allen, Cloudflare, CrowdStrike, Elastic, Fortinet, Rubrik, Zscaler, Orange Cyberdefense, ENISA, ABN AMRO, Crédit Agricole, Belfius, ASML, La Banque Postale. That is a European regulated-industry and cyber-defense roster, and it is where the money is being chased. Microsoft Foundry is the first cloud partner, with private deployment for Azure customers.

Pierre Stock, Mistral's VP of science, gave the pitch its cleanest form: "AI is going to be like electricity. You don't want to live in a world in which your neighbor can cut off electricity from one day to another," he told Wired. He also said of Chinese models: "You have no guarantee that they won't behave maliciously. They can be threat vectors."

That argument has teeth after this year's incidents, but the license undercuts the pure version of it. A bank that wants to run Mistral Large 4 on its own hardware under its own law gets exactly what it was promised. A European startup that wants to build a hosting business on it does not — that is the one thing the modified MIT forbids, which makes this open weight in the Llama sense, not the Apache sense.

The economics still favor Mistral against closed rivals. A model that is essentially tied with the best Chinese open weights on coding, charges $0.70 per million input tokens, and can be pinned to your own datacenter is a genuine third option for a security operations team that cannot send source code to an American API. On price it is now well below the Western frontier, and the token-efficiency claim — 47% fewer tokens per task on the coding index — matters more to a buyer than any single benchmark point, because it multiplies with the sticker price.

Who loses: the closed labs' defensive-security pitch, if the reproduce-and-patch behavior survives contact with real SOCs; and Chinese open-weight labs, which lose the "only game in town for self-hosting" argument in Europe. Who doesn't lose, yet: DeepSeek. On the cyber axis Mistral named, it is still ahead. And the "leapfrogged" framing has a shelf life measured in weeks — every Western open-weight move for three years has drawn a Chinese answer within a release cycle, and the open-weights gap is still a price list as much as a capability one.

The skeptical read

Judge this release the way you would judge a restaurant reviewing itself. FrontierCode 2.0 belongs to Cognition, which also builds a coding agent that would consume this model; the Artificial Analysis coding index scores cited were run ahead of the public harness; the Surge human-preference results (Mistral preferred 64-36 over GLM-5.3 and Kimi K3, 56-44 over DeepSeek, but losing 22-78 to Claude Opus 5.5) come from a vendor-commissioned blind test. None of that is dishonest, and Mistral publishes the losing numbers alongside the winning ones, which is more than most labs do. All of it is still unverified by anyone who did not get early access.

The claim that deserves the most suspicion is the one in Wired's headline. Coding, plausibly: a 0.4-point FrontierCode lead and a 1-point Terminal-Bench lead are ties within noise, but the human-preference results and token efficiency point the same direction. Cybersecurity, no. Mistral's headline benchmark has it third. The gap between "best open model for defensive security" and 51% against 57% is not a rounding difference — it is the difference between a lead and a press release.

What to watch

First, whether Artificial Analysis re-runs the full Intelligence Index on the final checkpoint; that single number will decide whether this is a coding specialist or a general model, and it is the one score Mistral cannot select. Second, the license's model-as-a-service clause in practice — whether European hosters pay for it or route around it to DeepSeek. Third, the Chinese reply, which historically arrives inside a month. Fourth, whether the vetted, less-moderated cyber variant that went to governments and incident responders in preview gets a public successor, because the defensive-security pitch only holds if enterprises can buy the build that does the reproducing and patching.

If your security team could download a frontier-adjacent model tomorrow, would it trust the weights more than the API? Write to us via our contact page.