Mistral released the weights of Mistral Large 4, the 1-trillion-parameter model it calls Le Chonk, on October 29, 2026. Near the end of the security section sits the most important sentence in the announcement. Mistral says that since the preview it has monitored cybersecurity-related use in its live traffic, and that "we see a potential for uplift to conduct real attacks. We are modifying our guardrails accordingly, and will continue updating them in the months to come."
That is an honest disclosure, and Mistral deserves credit for making it. But it describes a fix that, in my view, can only fully reach the traffic Mistral serves itself. A checkpoint that someone downloaded on October 29 keeps the behavior it had on October 29. Mistral should say plainly which of its promised guardrail updates will reach the open weights, and how.
What Mistral actually claimed
Mistral's announcement pitches the model as "Built for Coders, Trusted by Defenders." On security, it reports a score of 51% on the Artificial Analysis Cyber Index, which it says measures a model's ability to find, reproduce and patch vulnerabilities. It also reports "an average refusal rate of 96.6% on malicious cyber requests," which it calls "the highest we measure among open models." The Hugging Face launch post adds that the model scored 82% on the index's reproduce-and-patch test.
Then comes the caveat. Mistral says it saw the model refuse "black-box attacks against live targets," but still sees potential for uplift, and is changing its guardrails in response.
The license makes the release about as open as a large commercial model gets. Under the Mistral Ecosystem Open-Weight license, the model "is free to use, modify, fine-tune, and commercialize," with one condition: businesses that run a Model-as-a-Service offering need a separate commercial license from Mistral. Our guide to running Le Chonk covers the hardware side, and the reactions roundup covers the fight over that license.
Why the guardrail promise has a limit
Open weights exist to remove the provider from the loop. Mistral says so itself: organizations "can use and improve Mistral Large 4 without depending on Mistral to serve it through an API." Hugging Face puts it more directly: "open weight models put both the usage policy and the deployment under the user's control."
Both statements are true, and both cut against the guardrail promise. If Mistral changes a system prompt, a filter or a classifier in front of its own API, that change applies to calls to Mistral's API. It does not reach a copy running on a bank's own servers. If Mistral retrains the model so the refusals live in the weights, that only helps people who download the new checkpoint. Nobody is forced to.
Fine-tuning widens the gap. Hugging Face's post shows how to fine-tune the model with LoRA using its TRL library on a node of eight B300 GPUs. That example trains the model to reason in the language the system prompt asks for. In my view, the same tooling lets a determined operator shift other behavior too, and the license explicitly allows modification. The 96.6% refusal figure describes the model Mistral shipped, not every model built on top of it.
Mistral already knows this distinction matters, because it applies it to a more specialized product. Mistral is giving enterprise design partners such as Orange Cyberdefense preview access to a specialized variant of Mistral Large 4 for advanced cybersecurity work, including penetration testing and red-teaming. Mistral says "Access is subject to rigorous vetting and contractual safeguards, with testing restricted to owned or explicitly authorized systems in controlled environments." For the penetration-testing variant, the control is a contract and a gate. For the open model, the control is whatever was in the weights on release day.
Who wins anyway
None of this makes the release a mistake. Defenders are the clear winners. Hugging Face notes that vulnerability research and incident response "often appear like attacks in model input," so closed filters can block them, and that a team relying on an API "can also lose access in the middle of an incident." A model that a security team hosts itself solves both problems. Hugging Face also points out that open weights "let researchers measure the model's refusal behaviour directly instead of relying on the provider's description." That is a real safety benefit that closed models cannot offer.
The trade is reasonable. It just needs to be stated honestly, the way we argued that safeguards must sit outside an AI agent's reach rather than in instructions the agent can edit. A guardrail that the operator of an open model can change is a default, not a control.
What Mistral should do next
Three steps would turn a vague promise into something self-hosters can act on.
- Say where each fix lives. When Mistral updates its guardrails "in the months to come," it should say whether the change is in its hosted service, in a new checkpoint, or both.
- Version the weights with a changelog. If guardrails move into the model, ship a new, clearly named checkpoint and list what changed, so a bank or agency can decide to upgrade. The two launch posts already differ: Mistral's post says the released model resists 97.1% of attacks on the B3 Agent Security Benchmark versus 93.3% in Preview, while the Hugging Face post cites 93.3%.
- Use the license lever it already has. Model-as-a-Service providers need a separate commercial license. In my view, that contract is a natural place to require hosted resellers to carry Mistral's guardrail updates.
Mistral also said it saw potential for real attack uplift without saying what it saw. A short public write-up of those findings, with the details that are safe to share, would help every team now deciding whether to host the model.
The bottom line
Mistral made a defensible call: a strong, open model for defenders, with a refusal rate it says is the highest it measures among open models. But a pledge to keep updating guardrails "in the months to come" is a promise made in the language of an API provider. For open weights, the honest version is narrower: the safety you get is the safety in the file you downloaded, plus whatever you add yourself. Mistral should say that out loud, and give self-hosters a clear path to the fixes it ships later.
