Mistral opens the weights of its trillion-parameter ML4 model for cyber defence

Mistral released the weights of Mistral Large 4 (ML4), its trillion-parameter open-weight model, on October 29, letting businesses and governments download and deploy the system themselves.

The model, nicknamed Le Chonk, was first introduced earlier this month. Handing over the weights means buyers no longer have to route sensitive requests through someone else's endpoint; the model can sit in their own racks.

Mistral is pitching the release squarely at cybersecurity. The company said enterprises and public sector institutions can now download, deploy and own frontier AI to detect, analyse and respond to threats across code and IT infrastructure. As CEO Arthur Mensch put it, AI should be a tool for empowerment, not dominance.

On performance, Mistral says ML4 is comparable to the Chinese open-weight competitor GLM-5.3, previously regarded as one of the strongest open models in the world, particularly for cyber work. It argues its own model uses 47 percent fewer tokens per task, making it considerably more economical, and that ML4 outranks all other open models on Artificial Analysis' Coding Agent Index.

The real difference is the nature of access. Pierre Stock, Mistral's vice president of science, told TechCrunch that for a company or a government this means frontier intelligence to defend against cyberattacks, access that cannot be cut off by definition because the model is open-weighted. In practice it can be deployed on-premises and used to identify, coordinate and respond to major security incidents in real time.

Distribution runs on two tracks: the weights are hosted on Hugging Face, and the same model is available through Mistral's API, so buyers can choose between self-hosting and convenience.

The significance here is procurement logic rather than leaderboard position. Once governments start writing requirements that cyber defence AI must not depend on foreign closed vendors, open weights stop being an ideology and become a compliance tool. The questions to watch are who actually puts ML4 into critical infrastructure, and how closed-model vendors answer the claim that access can be revoked.