According to a Hugging Face blog post published October 29, 2026, Mistral has released Mistral Large 4 (nicknamed 'Le Chonk'), a multimodal, multilingual Mixture-of-Experts model that takes text and images as input and generates text. The post states the model has about 1 trillion total parameters, 49 billion active parameters, and a 1 million token context window. It is distributed under the Mistral Ecosystem Open-Weight License, described as an MIT derivative that limits model-as-a-service offerings.
Mistral positions the model for cybersecurity, coding agents, and multimodality. The post reports Mistral Large 4 scores 82% on the Artificial Analysis Cyber Index test, which asks a model to reproduce and then patch a real vulnerability in open-source software. Mistral states several closed frontier models score near zero on that test because they refuse the task. The company says it mainly positions the model for defensive security work and reports its average refusal rate on cyber prompts from JailbreakBench, StrongREJECT and AgentHarm is higher than any other open-weight model.
The post details the architecture, including a 72-layer text decoder, a 1.6B Pixtral vision encoder, and support for inference via Transformers, vLLM, and Llama.cpp. As of October 29, 2026, Hugging Face lists it as the fifth best open-weights model on Artificial Analysis.
- About 1T total parameters, 49B active, 1M token context window
- Scores 82% on the Artificial Analysis Cyber Index reproduce-then-patch test
- Released under the Mistral Ecosystem Open-Weight License (MIT derivative limiting model-as-a-service)
- Supports Transformers, vLLM, and Llama.cpp; GGUFs available from Unsloth and llama.cpp team
What it means for you
A new open-weight AI model is available that can run on infrastructure you control rather than through someone else's API. Its main selling point is defensive cybersecurity work and coding — it will attempt security tasks that some commercial models refuse. For most organizations running day-to-day operations, this is background noise: it matters only if you have a technical team already running self-hosted models. The headline numbers (1 trillion parameters) also mean serious hardware, not something you spin up casually.
Try this
If you have an internal security or engineering team, ask them one question: do we rely on a cloud AI API that could cut us off or refuse to help during a live security incident? That risk is the real point here, with or without this specific model.
Who should care
Security teams and engineering leads who self-host models, and anyone whose incident-response workflow depends on a third-party AI API that might refuse or revoke access mid-incident.
Skip this if
You don't have a technical team running your own model infrastructure, or you have no use case touching code and cybersecurity. For most owners and operations teams, this changes nothing this week.
Sources: Hugging Face — read the original