A trillion-parameter AI model that its developer says could help attackers carry out real cyberattacks is now free to download, modify and run outside the developer’s control.
Mistral AI released the open weights of Mistral Large 4, which it calls “Le Chonk,” on Thursday, weeks after putting the multimodal model into public preview. The Paris-based company said it had monitored cybersecurity-related use of the preview in live traffic.
“Though we observed the model refusing to comply with black-box attacks against live targets, we see a potential for uplift to conduct real attacks,” the company wrote in a blog post announcing the release.
Mistral is modifying the model’s guardrails and will keep updating them in the coming months, the post added.
Guardrails stop at the API
Those updates will not reach copies already downloaded. Pierre Stock, Mistral’s vice president of science, told CSO that the model ships with safeguards built into its weights, but later changes will go elsewhere.
“Subsequent safeguard updates are applied to our managed API and future model releases, rather than automatically updating downloaded checkpoints,” Stock said.
Asked which attack stages the model had meaningfully helped with in preview traffic, Stock did not name any. He said the most significant gains were in defensive work such as identifying, reproducing and remediating software vulnerabilities.
“While our public-preview monitoring showed the model refusing attacks against live targets, we recognise the potential for misuse as capabilities advance and are continuously strengthening our safeguards,” he said.
Hugging Face, which hosts the weights, noted in its own launch post that open weights put both the usage policy and the deployment under the user’s control.
In July, the UK’s AI Security Institute reported that leading open-weight models trailed the closed frontier on cyber tasks by four to seven months. For highly cyber-capable models, open release creates “a persistent and irreversible risk of misuse,” the institute said.
Attackers are already putting open-source AI tooling to work. Earlier this month, Microsoft said a China-aligned group used the agentic AI framework ARTEX to target more than 2,250 Microsoft 365 tenants.
Mistral says the released model can tell defensive work from malicious requests. According to the company, Large 4 refused 96.6% of malicious prompts in the cyber-related portions of the JailbreakBench, StrongREJECT and AgentHarm benchmarks, the highest rate it has measured among open models.
Niyati Daftary, principal analyst at Gartner, said security leaders should read that number narrowly.
“Mistral’s 96.6% figure tells you what their model does in their test scenario, not how it will behave with your data, your adversarial use cases or in production in your environment against motivated attackers,” she said.
Mistral is handling a specialized cybersecurity variant differently. Design partners such as Orange Cyberdefense are getting preview access to a version optimized for penetration testing, vulnerability assessment and red-teaming, the company said. Access is “subject to rigorous vetting and contractual safeguards,” the post said, and is limited to systems partners own or are authorized to test.
Benchmarks and EU obligations
The company said the model scored 51% on the Artificial Analysis Cyber Index, which measures how well a model finds, reproduces, and patches vulnerabilities. The chart in Mistral’s post shows two open-weight models, DeepSeek V4.1 Flash and MiMo-V2.6-Pro, scoring higher.
Mistral also calls Large 4 the best open-weight model for coding, citing leading scores on Cognition’s FrontierCode 2.0 and Terminal-Bench 4.0. It has not yet published the technical report behind those results and has said only that one is coming soon.
“Without a detailed technical report, the best open-weight model claim remains difficult to validate across workloads,” said Charlie Dai, vice president and principal analyst at Forrester.
Dai added that frontier models are evolving so quickly that leadership “can shift within months or even weeks.”
Stock said the report will document Mistral’s cyber evaluation methods and results, refusal testing and preview monitoring findings. Mistral also intends to share relevant adversarial testing findings “while safeguarding sensitive security information,” he said. He did not give a publication date.
ENISA, the EU’s cybersecurity agency, said in a statement published with Mistral’s announcement that it is testing the model to identify vulnerabilities, audit code and analyze defensive logs.
Under the EU AI Act, models trained with more than 10^25 floating-point operations (FLOPs) are presumed to carry systemic risk, according to the European Commission. Their providers must assess and mitigate those risks, report serious incidents and maintain cybersecurity protections. Mistral’s post does not say whether Large 4 falls into that category or what risk assessment preceded the release.
Stock said Mistral is a full signatory of the EU’s General-Purpose AI Code of Practice, including its safety and security chapter, which the Commission accepts as one way to demonstrate compliance. He did not say whether Large 4 has been classified as a systemic-risk model.
What it means for enterprises
Mistral released the model under a modified MIT license that permits use, modification, fine-tuning, and commercialization, the company said. Businesses running a model-as-a-service offering need a separate license. For those who would rather not host it, Mistral’s API is priced at $0.70 per million input tokens and $2.10 per million output tokens.
For European buyers, sovereignty is “a meaningful differentiator, but it should not outweigh security concerns,” Dai said. Open weights and self-hosting shift responsibility for guardrails, access controls, monitoring and misuse prevention to the operator, he added.
“Sovereignty and security therefore need to be evaluated together, not traded against each other,” Dai said.
Daftary said enterprises self-hosting Large 4 for code audit or vulnerability triage should run it as a controlled component, not an autonomous agent. That means isolated environments, least-privilege access to code and credentials, sandboxed generated code, and human sign-off before any remediation, she said. “Self-hosting can improve data control and operational continuity, but it also makes the enterprise solely responsible for patching, monitoring, evaluation and misuse prevention,” she said.
