Mistral released Le Chonk's weights. Put the cyber model in a sealed room

THE SIGNAL IN ONE SENTENCE

The weights arrived before the countdown finished. On October 27, Mistral's official repository still described the downloadable Mistral Large 4 artifact as an upcoming release estimated for October 31. On October 29, the files landed. That is a material change, not a fresh coat of launch paint. Mistral Large 4, nicknamed Le Chonk, had already been available through a hosted public preview. Now an organization can download the model, run it on infrastructure it controls, modify it and build its own serving and security layers around it. Mistral describes the release as a natively multimodal mixture-of-experts model with roughly one trillion total parameters and about 52 billion active parameters when embeddings and output layers are counted. It accepts text and images, supports tool calls and structured output, and offers low, medium and high reasoning modes. The company is emphasizing coding and cybersecurity. Mistral reports a score of 19.7 percent on Cognition's private FrontierCode 2.0 benchmark. It reports 48 percent on the Artificial Analysis Coding Agent Index while using 47 percent fewer tokens per task than the comparison it highlights. It also reports 41 percent on Terminal-Bench 4.0, up 13 percentage points from the public preview. For cybersecurity, Mistral reports 51 percent on the Artificial Analysis Cyber Index and an average refusal rate of 96.6 percent on malicious prompts drawn from three test sets. Those are vendor-presented results, even when an outside benchmark or partner contributed to the evaluation. They are useful reasons to test the model. They are not reasons to connect it to a production network on Friday afternoon. Open weights change who holds the controls. A hosted provider can change a guardrail, revoke access, inspect abuse signals or stop a service. A self-hosting organization can preserve a model revision, keep data inside its own environment, customize the system and continue operating without the original provider's endpoint. That is real freedom. It is also a transfer of maintenance, security and incident responsibility. The first home for a downloadable cyber-capable model should therefore be a sealed room. Not a literal bunker, unless the facilities team has been looking for a project. The sealed room is an isolated evaluation environment with no route to public targets, no production credentials, no customer data, a narrow set of disposable tools and an operator who can stop the run without asking the model for permission. Start with the artifact receipt. Record the official repository, exact revision, file hashes, tokenizer, configuration, vision components, draft head, quantization, prompt template, inference engine and container image. Mistral's model card documents a full checkpoint and an NVFP4 quantized checkpoint aimed at Blackwell GPUs. It includes serving paths for vLLM and SGLang and lists other ecosystem support. The example vLLM and SGLang configurations use an eight-GPU tensor-parallel setup. That is a deployment example, not a promise that every eight-GPU box will deliver the advertised behavior. Hardware, interconnect, precision, context length, concurrency, speculative decoding and runtime versions all change the operating result. Pin them. If the model is later re-quantized or served through another engine, treat that as a new build. Re-run the acceptance set instead of assuming that the friendly nickname survived the trip intact. Then read the license. Mistral calls the terms the Mistral Ecosystem Open-Weight License, a modified MIT license. The company says the model may be used, modified, fine-tuned and commercialized, but a business operating a Model-as-a-Service offering needs a separate commercial license from Mistral. That condition belongs in the architecture document, not in a tab somebody remembers after procurement. Open weights do not mean every commercial arrangement is identical. They do not mean the training data is public. They do not mean the complete training process is reproducible. They mean the learned parameters can leave the provider's server under the attached terms. That is enough to create important choices. It is not enough to skip legal review. The cyber test should begin with authorization, not capability. Write down the exact systems the model may inspect. Use synthetic repositories, intentionally vulnerable applications and isolated replicas of owned systems. Give the model credentials that expire with the test. Block outbound network access unless a specific scenario requires a controlled destination. Do not let a benchmark prompt quietly become an internet scan. Every target should have an owner, a written scope and a reason the model needs access. The model's tools should be boring and few. Mistral's own model card recommends keeping the tool set well defined and limited to the minimum required for the use case. Follow that advice aggressively. A code reviewer may need repository read access, a compiler, a test runner and a patch workspace. It does not need cloud administrator credentials, production deployment rights, the customer database and a shell on every machine in the company. If a tool can write, delete, publish, spend or contact another system, place a human approval gate in front of it. The first acceptance set should measure defensive usefulness. Give the model real but sanitized bug reports. Ask it to locate the relevant code, reproduce the issue in an isolated environment, propose a patch and run the existing tests. Score whether the bug was reproduced, whether the patch closes the issue, whether unrelated tests break, whether the explanation matches the change and how much human review was required. Then add the ugly cases. Use incomplete reports, misleading stack traces, vulnerable dependencies that are not reachable, and findings where the safest answer is to ask for more evidence. A cyber model that finds every vulnerability by inventing half of them is just a very expensive smoke alarm beside a toaster. Measure false positives, not only celebrated catches. Now test the boundary. Mistral says the model's guardrails distinguish defensive from malicious cyber requests. It reports the 96.6 percent refusal figure across JailbreakBench, StrongREJECT and AgentHarm prompts. The company also says it has observed potential uplift for real attacks and is modifying its guardrails. That sentence deserves more attention than a leaderboard trophy. It acknowledges the central problem with a capable security model: the same understanding that helps reproduce and patch a vulnerability can help someone exploit it. Run a misuse evaluation inside the sealed room. Test direct malicious requests, role-play, fictional framing, encoded instructions, multi-turn escalation, tool-result injection and requests that begin as benign analysis before asking for an unauthorized action. Record both errors. A refusal that blocks ordinary defensive work is costly. Compliance that enables harmful action is dangerous. The useful measure is not one refusal percentage. It is whether the boundary fits the organization's authorized work and remains stable after system prompts, fine-tuning, quantization and tool integration. Self-hosting makes that local evaluation possible. It also means a later provider guardrail update will not automatically reach the copy already sitting in the rack. Create an update policy before the first deployment. Monitor Mistral's model card, release notes, license and safety disclosures. Record which change requires a new download, which requires an evaluation refresh and which requires an immediate hold. Keep the previous approved artifact available for rollback. Do not silently replace the model behind a production endpoint. The audit log needs to be outside the model's authority. For every run, preserve the user request, system policy, model revision, tool list, permissions, target scope, actions, outputs, approvals, errors, resource use and final disposition. If the model writes code, preserve the diff and test evidence. If it makes a security claim, preserve the reproduction steps and the human review. If it is blocked, record what boundary fired. Logs should be tamper-evident and readable by the incident team without needing the model service to be healthy. The system under review should not own the only copy of the review. Then rehearse shutdown. Disable the model endpoint. Revoke its credentials. Stop tool execution. Quarantine the artifact and session state. Confirm that production service continues without it. Restore the approved version from known files. Reconcile any proposed or completed changes. Time the exercise. An organization that can download a model but cannot contain it has achieved portability, not control. The same rule applies to digital sovereignty. Mistral says Large 4 was trained from scratch on European infrastructure and can be deployed under an organization's own control. That gives European institutions a serious alternative to depending only on remote foreign endpoints. But sovereignty is not a birthplace sticker. It is the ability to inspect the terms, choose the hardware, control the data, set permissions, audit the operation, replace a component and recover from failure. The open-weight release makes more of that possible. The operator still has to do it. This release is especially useful because it closes the gap between a hosted preview and a downloadable artifact sooner than the repository's earlier estimate suggested. The files, model card, license and serving recipes now give outside teams something concrete to inspect. That should improve independent evaluation. It should also cool the urge to treat a company benchmark as the final verdict. Run Le Chonk on the repositories, languages, hardware and failure conditions that actually matter. Publish what it fixes. Publish what it misses. Publish what it refuses. Publish what it should have refused. Open weights are an invitation to verify. The sealed room is where that invitation becomes evidence.