Evidence at a glance
From API Access to Deployable Weights
Mistral introduced Mistral Large 4 in October 2026. It opened an API preview on October 6, then presented the now-available weights on Hugging Face on October 29. The model is a multilingual, multimodal mixture-of-experts system that takes text and images and generates text. It has about one trillion total parameters, 49 billion active parameters, and a context window of one million tokens, and is positioned for coding agents, multimodal tasks, and defensive cybersecurity work.
For security teams, open weights change how the model can enter a workflow. Vulnerability research and incident response often require reproducing attack behavior to confirm a bug and verify a patch, yet such inputs may trigger filters on hosted services. During an incident, teams may also avoid sending code or samples to an external API or relying on a service that could become unavailable. Self-hosting does not solve every problem, but it lets teams bring execution location, data flows, and policy control into their own system design.
Two Forms of Sparsity, Two Different Jobs
Large 4 combines two distinct forms of sparsity. Its MoE router selects four of 128 experts for each token, alongside one shared expert that always runs, for five active experts per token. The first layer uses a dense feed-forward network, while the remaining 71 use MoE blocks. Rather than sending every token through every expert, the model selects which experts participate.
The attention mechanism applies a different kind of selection. MLA compresses the KV representation, while a DSA indexer selects up to 2,048 earlier positions for each query. The first mechanism limits which experts compute a token; the second limits which context positions attention reads. They are related forms of sparsity, but they do different jobs. The model also shares KV state across layers, alternates RoPE and NoPE layers, and uses a 1.6-billion-parameter Pixtral encoder for images. A million-token window allows very long inputs, but does not mean every query attends equally densely to the entire history.
What the 82% Score Does—and Does Not—Show
The most directly relevant evidence for defensive work comes from the Artificial Analysis Cyber Index. The test asks a model to reproduce a real vulnerability in open-source software and then patch it. Mistral Large 4 scored 82%. Mistral says several closed frontier models scored near zero on the same test because they refused to attempt the task. That points to a practical tension: a system that treats all vulnerability reproduction as harmful may also block work needed to verify and fix vulnerabilities.
The score should not be read as an 82% reliability rating for cybersecurity, nor as proof that the model can independently handle real incidents. It measures one specific reproduce-and-patch task. Mistral also reports that internal tests found the model useful for malware analysis, vulnerability prioritization, and writing detection rules, but those are company-reported results, not the same kind of evidence as the benchmark score. The cautious conclusion is that the model shows capabilities worth testing in defensive workflows, not that it has already passed production acceptance.
Deployable Does Not Mean Easy to Deploy
Open weights give teams the option to place the model near their own codebases, crash logs, and malware samples, then build an internal chain for vulnerability reproduction, patch generation, and verification. The value is not limited to privacy. During incident response, teams can reduce dependence on one API's availability and filtering policies, while researchers can directly inspect when the model refuses or complies under different prompts. If reproduction results are verifiable, patching traces could also inform training smaller security models or building reinforcement-learning environments. Those are possible directions, not capabilities delivered automatically by the release.
The first cost is hardware. The available material describes local paths including Q2_K quantization on Apple Silicon Ultra and an NVFP4 version for NVIDIA Blackwell GPUs; the 2-bit route requires 512 GB of unified memory. It records roughly 90 for prefill and 15 tokens per second for generation on an M3 Ultra running Q2_K. These figures can help estimate feasibility for particular hardware and quantization choices, but they do not replace measuring latency, throughput, and concurrency under a team's target workload. For a technical lead, having the weights and serving the workflow at an acceptable cost are separate acceptance questions.
Open Weights Still Have Licensing and Safety Limits
Mistral Large 4 is distributed under the Mistral Ecosystem Open-Weight License. It is an MIT-derived license, but it is not unrestricted: operating a model-as-a-service business requires a separate commercial license from Mistral. Self-hosting and offering a hosted service to others are therefore different activities. Before embedding the model in an internal tool or making it available to customers, teams should check the relevant license and commercial terms separately.
Open weights have not removed the model's refusals. Mistral says its average refusal rate on cybersecurity prompts from JailbreakBench, StrongREJECT, and AgentHarm is higher than that of any other open-weight model. For defensive teams, that means greater control does not guarantee the model will respond as expected to every request. For governance teams, the ability to measure refusal behavior directly is an advantage. A sound approach is not to delegate security screening entirely to the model, but to measure false refusals and unsafe compliance in the team's own environment, then decide which steps require human review and which outputs must be verified by tests or patches.