According to a Hugging Face blog post published October 29, 2026, Mistral has released Mistral Large 4 (nicknamed 'Le Chonk'), a multimodal, multilingual Mixture-of-Experts model that takes text and images as input and generates text. Hugging Face states the model has about 1 trillion total parameters, 49 billion active parameters, and a 1 million token context window. It is distributed under the Mistral Ecosystem Open-Weight License, described as an MIT derivative that sets limits for model-as-a-service offerings.
Mistral positions the model for cybersecurity, coding agents, and multimodality. The post reports Mistral Large 4 scores 82% on the Artificial Analysis Cyber Index test, which asks a model to reproduce a vulnerability in open-source software and then patch it. Mistral says several closed frontier models score near zero because they refuse the task. The company reports the model was also useful for malware analysis, vulnerability prioritisation, and writing detection rules. On cyber prompts from JailbreakBench, StrongREJECT and AgentHarm, the post says its average refusal rate is higher than any other open-weight model.
The post details the architecture, including a 72-layer text decoder, a 1.6B Pixtral vision encoder, and inference support via Transformers, vLLM, and Llama.cpp. As of October 29, 2026, it is the fifth-best open-weights model on Artificial Analysis.
- About 1T total / 49B active parameters, 1M token context window
- Released under the Mistral Ecosystem Open-Weight License (MIT derivative)
- Scores 82% on the Artificial Analysis Cyber Index; positioned for defensive security work
- Supports Transformers, vLLM, and Llama.cpp; fine-tunable with TRL
What it means for you
A new open-weight model you can run and modify yourself, rather than only renting through an API. Its headline claim is a cybersecurity one: it will attempt to reproduce and patch software vulnerabilities, work that some closed models refuse. For most organizations this is a development to note, not act on — it matters chiefly to teams that run their own infrastructure or do security work in-house.
Try this
If you have a security or dev team, ask them what they currently can't do because a vendor's API refuses or blocks the request — that's the gap a self-hosted model like this is meant to close. Map that before anyone downloads anything.
Who should care
In-house security teams, incident responders, and engineering groups who run their own model infrastructure and have hit refusal or access-loss problems with hosted APIs.
Skip this if
You don't have engineers running your own infrastructure, or your security work is handled by a vendor. Benchmark rankings and parameter counts change monthly and don't change how your operations run. A self-hosted model this large is a real engineering commitment, not a plug-in — and any patch it suggests still needs a person to review before it touches production.
Sources: Hugging Face — read the original