Mistral gives away a trillion-parameter AI model: anyone can download and run it themselves

French company Mistral released to the public on Thursday, October 29, 2026, the weights of its new AI model called Large 4 — which the company nicknames "Le Chonk". Unlike most large models, which are available only through online services, anyone can now download Large 4 from Hugging Face and run it on their own servers.

Large 4 was first shown as a public preview on October 6. The version now released has been improved after three more weeks of training and testing with governments and corporate users. It is a "mixture-of-experts" model with about one trillion total parameters — although only around 49 billion are active for each token — a one-million-token context window, and it accepts text and image input.

Mistral is pitching Large 4 mainly to cyber defenders: it says the model finds and fixes security flaws in software. According to the company, it scores 51% on the Artificial Analysis Cyber Index, and refuses 96.6% of malicious cyber requests in its tests. On coding, it says it scores 48% on the Artificial Analysis Coding Agent Index — tied with China's GLM-5.3, but using 47% fewer tokens per task — and 41% on Terminal-Bench 4.0, up 13 points from the preview. Hugging Face also reports 82% on a vulnerability reproduce-and-patch test, and 93% on Cybench, a set of 40 security challenges.

Its licence is a modified MIT licence: free to use, modify, fine-tune on your own data, and sell products built on it — except that companies offering the model itself as a paid hosted service (Model-as-a-Service) need a separate commercial licence from Mistral. Through Mistral's own API, pricing is $0.70 per million input tokens and $2.10 per million output tokens.

The news comes a day after Google announced Gemini 4 Carbon — its new cyber-defence model which, for now, is available only to a small group of selected defenders through its Fairwind Program. Mistral is taking the opposite approach: instead of locking the model up, it is opening it. Mistral's vice president of science, Pierre Stock, told Reuters: "I'm not comfortable living in a world in which open weights do not exist." He added that once a model is out, "it's impossible to contain access." That protects users from being cut off, but it also means anyone can use it.

Mistral itself acknowledges the risk. The company says that during the preview it saw "a potential for uplift to conduct real attacks", and it is tightening its guardrails. A more powerful specialised version for penetration testing goes only to vetted partners, not to the public. Companies including Booz Allen, CrowdStrike and Elastic, along with Europe's cybersecurity agency ENISA, are reported to have tested the model. A full technical report is still coming, and most of these figures are Mistral's own — not yet confirmed by independent testing — but researchers can now test them themselves, because the weights are open.

One practical point, too: a model this large does not run on an ordinary phone or laptop. Running it yourself needs powerful servers. For most businesses and individuals, the easiest way to use it will be through an API or a cloud service — but unlike with closed models, you can choose your provider, or switch later without losing the model itself.

What does this mean for you?

Small business: You do not need to run this model yourself to benefit. Security tools built on an open model can become cheaper and easier to get, because many competitors can build them. But the old rule still holds: keep your software updated, use two-factor authentication, and don't click suspicious links.

Developers and tech students: This is a chance to learn hands-on. An open model means you can test it, fine-tune it on small datasets, and see how it works — without paying a large monthly fee or asking for permission. If you are studying technology, skills in cybersecurity and running open models are becoming more valuable.

Banks, mobile money services and public institutions: For organisations that cannot send code or sensitive logs to a US API, a model that can run on their own servers is a strong argument. It can help find flaws before hackers exploit them, while data stays inside the organisation. But this openness is a double-edged sword: attackers can download it too — so defences must stay one step ahead.

Parents and teachers: School systems hold children's data. As flaw-finding tools become widely available, schools and learning platforms must update their defences faster. Ask your child's school: how often are your systems updated, and who protects children's data?