Mistral Says Le Chonk Is the Best Open Model for Cyber Defense. Its Own Chart Puts It Third

Mistral has released the weights of Mistral Large 4, the trillion-parameter model it nicknamed “Le Chonk,” and it’s pitching the result as “Built for Coders, Trusted by Defenders.” Anyone can now download it from Hugging Face and run it on their own hardware. The coding claims mostly hold up. The cyber-defense crown is shakier, and the evidence for that sits in Mistral’s own launch post.

That’s still a real achievement for a European lab working with far less money than its American and Chinese rivals. But “best open model for cyber defense” is a marketing line, and the numbers say something narrower: Le Chonk is fast, cheaper than it was three weeks ago, unusually good at saying no to obvious hacking requests, and very good at code. It is not the top open model at the security tasks it’s being sold for.

What Mistral actually shipped

According to the model card, Large 4 is a mixture-of-experts model. That design splits the network into many specialist sub-networks (“experts”) and only switches on a few for each word it processes. Le Chonk has 128 routed experts with four active per token, plus one shared expert. That’s how a model with about 1 trillion total parameters runs with only 49 billion active per token (52 billion counting the embedding and output layers).

Mistral says it was trained from scratch on 3,800 Nvidia Grace Blackwell GPUs in the company’s own European data centers. It takes text and images in and puts text out, supports a 1-million-token context window, and has three reasoning settings (low, medium and the default, high) so the same weights can handle a quick reply or a long agent run. The card also lists fluency in more than 160 languages, including every official EU language.

The weights come in two official versions, FP8 and a compressed NVFP4 build for Nvidia’s Blackwell chips, per Hugging Face’s launch post. There’s day-one support in vLLM, SGLang, transformers and llama.cpp. The API price is now $0.70 per million input tokens, $0.07 per million cached input tokens and $2.10 per million output tokens.

Mistral introduced the model in a public preview earlier this month. Here’s its own introduction video from its official YouTube channel:

“Open” with one string attached

The license is the Mistral Ecosystem Open-Weight License, which Mistral describes as a modified MIT license. You can use, modify, fine-tune and sell products built on the model for free. The single condition: a business that runs a “Model-as-a-Service” offering, meaning it sells access to the model itself as a hosted API, needs a separate commercial license from Mistral first.

Our read: that clause is aimed squarely at cloud resellers who would otherwise undercut Mistral’s own API with Mistral’s own weights. For a bank or a government agency running it on internal servers, it changes little. For an inference startup, it’s the whole question.

“Run it yourself” also needs an asterisk on the hardware. Hugging Face’s guide runs the FP8 version on a node of eight Nvidia B300s and offers a hosted recipe on eight H200s. The Decoder, citing SGLang’s docs, says a more compressed variant fits on four GB300s. Rough math: at one byte per parameter, the FP8 weights alone come to about a terabyte. Community GGUF quantizations exist, but this is data-center hardware, not a gaming PC.

The coding claims mostly hold up

Mistral’s strongest case is code. All of the following figures are company-reported in its launch post:

• Terminal-Bench 4.0: 41%, up 13 percentage points from the preview’s 28%, which Mistral says puts it ahead of every open model it compared against, with 30% fewer output tokens than the preview.
• Cognition’s FrontierCode 2.0, a private test of whether a repository maintainer would merge an agent’s change: 19.7%, narrowly ahead of DeepSeek V4.1 Flash at 19.3% in Mistral’s chart.
• Artificial Analysis Coding Agent Index: 48%, “effectively tied” with GLM-5.3 while using 47% fewer tokens per task on average.
• Surge Code blind comparisons: graders preferred Le Chonk’s answers over GLM-5.3, Kimi K3 and DeepSeek V4.1 Flash, but it won only 22% of matchups against Anthropic’s Claude Opus 5.5.

Two caveats. First, “best open model” is a statement about who’s in the comparison. The Decoder points out that Mistral’s charts leave out Moonshot’s Kimi K3.1 Pro, whose weights aren’t public yet; it reports that Moonshot plans to release them by Nov. 4 and that K3.1 Pro scores 67% on Terminal-Bench 4.0. If that release happens, Le Chonk’s coding lead among open models could last about a week.

Second, the gap to the closed frontier is large. The Decoder reports Claude Opus 5.5 at 46% on FrontierCode 2.0, more than double Le Chonk’s 19.7%, and Claude Code with Opus 5.5 at 62 on the Coding Agent Index versus Le Chonk’s 48.

The cyber crown, checked against Mistral’s own chart

Here’s where the pitch outruns the data. Mistral’s post says the model “leads open-weight benchmarks in coding and defensive security,” and the model card calls it “state of the art among open-weight models for security work.” The headline number is 51% on the Artificial Analysis Cyber Index, which tests whether a model can find a vulnerability in a codebase, reproduce it and patch it without breaking anything else.

The same post’s chart for that index lists DeepSeek V4.1 Flash at 57% and MiMo-V2.6-Pro at 56%. Both are open-weight models that The Decoder groups with China’s strongest, and both score higher. As The Decoder noted, that makes Le Chonk third among open models on the very index Mistral cites, just ahead of GLM-5.3 Flash at 50%. The Decoder also reports that Artificial Analysis scored the preview at 50, so three more weeks of training moved this number by one point, and that a full Cyber Index run costs about $1.21 per task with Le Chonk versus less for the higher-scoring DeepSeek model.

So where does “leads in defensive security” come from? The most generous reading is the combination: strong scores plus refusals. Mistral reports a 96.6% average refusal rate on the cyber-related prompts in three public jailbreak and misuse test sets (JailbreakBench, StrongREJECT and AgentHarm), the highest it measured among open models, and 97.1% resistance on the B3 agent-security benchmark, up from 93.3% for the preview. Hugging Face’s post adds a company-reported 82% on one Cyber Index sub-test where a model must reproduce and patch a real open-source vulnerability, and says Mistral reports some closed models score near zero there because they refuse the work.

That’s a legitimate selling point. Defenders have to reproduce a bug to fix it, and a model that won’t touch exploit code is useless to them. But “refuses bad requests most often and helps defenders without fuss” is a different claim from “best at defense,” and only the first one is in Mistral’s numbers.

How it ranks overall

On Artificial Analysis’ new Intelligence Index v5, a nine-test aggregate, Mistral’s model card puts Le Chonk at 26 and says that’s “the highest among western open-weight models,” while conceding that “the leading open-weight models from China score higher.” The Decoder fills in the gap: DeepSeek V4.1 Flash and GLM-5.3 at 32 each, MiMo-V2.6-Pro at 30, and Google’s Gemini 4 Carbon, which we covered earlier this week, leading everything at 59. The preview scored 25, so the extra training bought one point overall.

Where Le Chonk does stand out is speed and efficiency. Per The Decoder’s reading of Artificial Analysis data, it generates 161 tokens per second (up from 111 for the preview), and the average index task now costs $2.06, down from $5.54. That’s cheaper than GLM-5.3 at $5.01, but well above DeepSeek V4.1 Flash at $0.60 and MiMo-V2.6-Pro at $0.26.

Preview to weights in three weeks: what changed

Putting Mistral’s and Artificial Analysis’ numbers side by side shows where the extra reinforcement learning went. All figures are preview versus final release:

• Terminal-Bench 4.0: 28% to 41% (Mistral). The biggest jump by far.
• Cyber Index: 50 to 51 (Artificial Analysis, via The Decoder). Essentially flat.
• Intelligence Index v5: 25 to 26 (Artificial Analysis, via The Decoder). Flat.
• Malicious cyber-request refusals: 95% to 97% in Mistral’s chart. Up slightly.
• List API price per million tokens: $1.36 input and $4.18 output during preview, now $0.70 and $2.10 (The Decoder and Mistral).

Mistral’s line that “gains continue to accelerate, with no signs of saturation” is about its coding and security training curves. The independent aggregate scores don’t show acceleration yet. They show a model that got much better at one kind of agentic coding task, much cheaper to run, and about the same at everything else.

The sovereignty pitch, and the dual-use problem

Mistral’s real argument isn’t a leaderboard. It’s control. “AI is going to be like electricity. You don’t want to live in a world in which your neighbor can cut off electricity from one day to another,” Mistral VP of science Pierre Stock told reporters, according to Wired. “Once you open source the weights, they’re all over the internet. It’s impossible to cut off access.” Stock also said of Chinese models: “You have no guarantee that [Chinese models] won’t behave maliciously. They can be threat vectors.”

The launch post backs that with quotes from Booz Allen, Cisco, Cloudflare, CrowdStrike, Elastic, Microsoft, the European Space Agency’s Φ-lab and several European banks, including ABN AMRO, Belfius, Crédit Agricole and La Banque Postale. Microsoft says it’s the first cloud provider offering the model, through Microsoft Foundry.

The catch is the one Stock’s own quote implies: weights that can’t be switched off can’t be switched off for anyone. “It’s clearly a dual-use technology,” Rafe Pilling, senior director of threat intelligence at Sophos, told Wired. He also pushed back on the national framing: “The technical realities and the narrative—which often has a nationalistic leaning—are two different things.” According to The Decoder, Mistral admits the model could make real attacks easier and plans to tighten safeguards in coming months, and a separate penetration-testing variant is available only to vetted partners such as Orange Cyberdefense under contract.

Our read: refusal rates measure how a model behaves as shipped. Once weights are public, fine-tuning can strip refusals out, which is exactly the scenario a 96.6% score can’t speak to. Mistral keeping its offensive variant gated is a quiet admission of that.

What to watch next

• Kimi K3.1 Pro’s weights. If Moonshot publishes them by Nov. 4 as The Decoder reports, Le Chonk’s “best open coder” title faces a model that scores 67% on Terminal-Bench 4.0 to its 41%.
• The technical report. Mistral says a full one is “coming soon.” It should show how the reinforcement-learning tasks were built and whether the cyber scores hold on tests Mistral didn’t pick.
• Stripped fine-tunes. Watch Hugging Face for community variants with the refusals removed. How fast they appear will test the dual-use worry more directly than any benchmark.
• Who signs the service license. The Model-as-a-Service clause makes the first third-party hosts besides Microsoft a signal of whether Mistral can monetize open weights without being undercut.

This story is based on Mistral’s Oct. 29, 2026 release materials, the Hugging Face model card and launch post, and reporting available as of Friday afternoon, Oct. 30.

Hype in. Signal out.

Image: Mistral AI co-founder and CEO Arthur Mensch (right) meets UK Prime Minister Keir Starmer at 10 Downing Street, Jan. 9, 2025. Photo by Simon Dawson / No 10 Downing Street, via Wikimedia Commons, Open Government Licence v3.0; cropped to 16:9.