Mistral Saw Its Own Model Could Help Real Attacks, Then Published 1TB of Weights

AI 요약

• Mistral shipped roughly 1,061GB of FP8 weights for 1T-parameter Large 4 on October 29.
• Mistral says preview traffic showed potential uplift for carrying out real attacks.
• Selling inference access to third parties needs a separate Mistral commercial license.

The weights for Mistral Large 4, a trillion-parameter model its own maker says could help carry out real attacks, are now a public download. The FP8 checkpoint that landed on Hugging Face on October 29, 2026 runs about 1,061GB. Mistral's announcement post hit 971 points on Hacker News the same day, the highest-ranked AI story of the day.

The warning is inside that announcement. Mistral wrote that while watching cybersecurity usage in live preview traffic, it saw "a potential for uplift to conduct real attacks," and that it is modifying its guardrails accordingly and will keep doing so. The cyber-specialized variant, which pushes offensive capability further, goes only to design partners such as Orange Cyberdefense, behind vetting and contractual safeguards. The general release carries no such gate.

What three more weeks of RL changed

Large 4 first shipped as an API preview on October 6, when Mistral said the weights would follow on October 27. They arrived two days late. In the three weeks between, Mistral ran more reinforcement learning, and most of the numbers it publishes went up.

Coding moved the most. Terminal-Bench 4.0 went from 28% to 41%, a 13-point gain, and Mistral says the same tasks now consume 30% fewer output tokens. That was the preview's loudest complaint: reviewers called it a token hog. Reasoning effort is now three settings, low, medium and high, with high as the default.

Mistral's claim to the "best open-weight coding model" does not match its own chart. On the Artificial Analysis coding agent index printed in the Hugging Face model card, Large 4 scores 48% and GLM-5.3 scores 49%, one point higher. Mistral calls that "essentially tied" and adds that Large 4 spends 47% fewer tokens per task.

Price dropped about 49% against the preview's list rate. But a half-price promotion was already running during the preview ($0.68 input, $2.09 output), so what teams actually paid barely moved. What changed is that nobody has to plan around a discount expiring.

Whoever downloads the weights can strip the guardrails

The guardrails Mistral is tuning work on the API path, because requests pass through Mistral's servers. For anyone who downloads the weights, they do not. A model running on your own hardware never shows Mistral its responses, and further training can sand down its refusal behavior.

That was the dominant thread in the Hacker News discussion. One commenter (kouteiheika) called guardrails on open-weight models "security theater," and replies pointed to prefill and fine-tuning as the standard bypasses. On the 96.6% refusal rate, others argued that a refusal number means nothing without the false-refusal rate beside it, since a model that refuses at random scores well on one and badly on the other. Mistral's announcement does not publish a false-refusal figure.

Mistral did withhold the riskier artifact. The cyber-specialized variant, built for penetration testing, vulnerability assessment and red teaming, is not public, and its partner contracts restrict testing to systems the partner owns or has explicit authorization to probe. The live-traffic observation Mistral described applies to the general model. It confirmed the model refuses black-box requests to attack live targets, while still seeing room for capability uplift. The general weights went out after that observation, unchanged.

Free inside your company, a contract if you resell inference

During the preview the license was listed only as "Open." The full text is now out, named the Mistral Ecosystem Open-Weight License. It is a modified MIT license that permits use, modification, redistribution, sale and further training. One clause is the exception.

How you use it	Commercial license required
Internal use only, not offered to third parties	No
Model embedded in a specific feature of your app for end users	No
Forwarding requests to a model someone else hosts	No
Offering the model or a fine-tune to third parties for inference or post-training, where they meaningfully control inputs, parameters or training data	Yes

That last row is the Model-as-a-Service clause. There is no revenue or user-count threshold. Any business selling inference access needs to contact Mistral for a contract, at any scale. The previous generation, Mistral Large 3, was Apache 2.0, and the competing open-weight models GLM-5.3 and DeepSeek V4.1 Flash are MIT (per Mistral's own docs). Neither carries a clause like this.

On Hacker News the clause drew the argument that this is not open weights but "weights available." The phrase "meaningfully control" is vague enough that commenters split over whether a startup embedding the model in its own product falls inside or outside it. Teams using it for internal tooling or as a feature of their own app have nothing to check. Platforms that expose a model endpoint to customers need legal review.

What you can run today

The API works now. Self-hosting is a hardware problem.

Item	Detail
Who	API: developers with a Mistral Studio account and key. Weights: teams operating GPU servers
Price	Per million tokens, $0.70 input, $0.07 cached input, $2.10 output. EU-resident processing adds 10%, at $0.77 / $2.31
Region availability	No geographic restriction published on the API or the weights download. Regional endpoints exist only for the EU and the US, so callers in Singapore and the rest of APAC use the global endpoint, with no published APAC region or data-residency option
Self-hosting	FP8 at about 1,061GB, NVFP4 quantization at about 610GB (for Blackwell GPUs). The model card's serving example is one node of 8 GPUs
Where it is served	Mistral API, OpenRouter, Hugging Face, NVIDIA NIM, Microsoft Foundry (first cloud provider)

The model activates only about 49B of its trillion parameters per token. Storage is still the gate, because the full weights have to sit in memory. One Hacker News user reported that four H200s (540GB total) cannot hold even the 4-bit quantization. The context window is 1M tokens per the model card, and it accepts text and images as input.

If your team already runs GLM-5.3 or DeepSeek V4.1 Flash, the cheapest way to settle this is to push 20 of your actual tasks through the Large 4 API under the same conditions and log results and output token counts side by side. One point separates it from GLM-5.3 on the coding agent index, so the leaderboard decides nothing, and Mistral's 30% token reduction only shows up on your invoice if it holds on your workload. If you resell model access to customers, read clause 2 against your own service shape before you plan any self-hosting, or the hardware budget may not survive the legal review.