Mistral showed Large 4 as a public preview earlier this month. On Thursday the weights went out: a trillion parameters, natively multimodal, trained from scratch on European infrastructure.
Three more weeks of reinforcement learning sit between the preview and the release, and they show. On Cognition’s private FrontierCode 2.0 benchmark, which asks whether a repository maintainer would actually merge an agent’s change, Mistral Large 4 leads with 19.7% ahead of GLM-5.3 (19.3) and DeepSeek V4.1 Flash (17.8). On Terminal-Bench 4.0 it scores 41% against 28% in the preview, with 30% fewer output tokens.
Cheaper per task, not just better
The more interesting number is in Artificial Analysis’s Coding Agent Index. Mistral Large 4 scores 48% there, effectively level with GLM-5.3, but gets there on 47% fewer tokens per task. For agents that run for hours, that is the difference between affordable and not. Three reasoning modes let you pick where to land between speed and thoroughness; the lowest one replaces the old “None” setting.
In Surge Code’s blind pairwise test, where human graders compare two answers without knowing the source, Mistral Large 4 beats GLM-5.3 and Kimi K3 by 64 to 36 each and DeepSeek V4.1 Flash by 56 to 44. Against Claude Opus 5.5 it loses 22 to 78.
Built for defenders, with the risk admitted
Mistral is pitching this model squarely at security teams. On Artificial Analysis’s Cyber Index, which measures finding, reproducing and patching vulnerabilities, it scores 51%—and does so without the refusals that sink such tasks on other models. At the same time its average refusal rate on malicious cyber prompts is 96.6%, by Mistral’s own measurement the highest among open models.
What Mistral writes next is worth reading twice. The company monitored live traffic, saw the model refuse black-box attacks against real targets, and still sees “a potential for uplift to conduct real attacks.” Guardrails are being modified. A specialised cyber variant for penetration testing and red-teaming goes only to vetted partners such as Orange Cyberdefense, contractually limited to owned or authorised systems.
The licence is called the Mistral Ecosystem Open-Weight License and is a modified MIT: use, modify, fine-tune and commercialise freely, with one condition—anyone running the model as a Model-as-a-Service offering needs a separate commercial licence. Weights are on Hugging Face and run under vLLM or SGLang; if you want it managed, it is on Microsoft Foundry.
Openness as the security pitch
Ten security vendors carry quotes under the announcement, from Booz Allen to Zscaler, plus the EU agency ENISA. The argument is always the same: a defence you do not control is not a defence. It is a good argument, and it cuts both ways. The same openness that lets ENISA audit the model takes away Mistral’s ability to tighten a guardrail after the fact. What has been downloaded stays downloaded—including the version whose uplift risk is named in Mistral’s own blog post.