Mistral Large 4 preview: what open weights mean for AI security teams

What was announced

On 6 October 2026 Mistral released a preview of Mistral Large 4 through its API. Per Simon Willison's write-up, it is a 1 trillion parameter model with 49 billion active parameters, trained on Mistral's own cluster of 3,800 NVIDIA Grace Blackwell GPUs. Mistral says the open-weights model will follow at the end of the month.

On capability, Willison reports a score of 38 on Artificial Analysis. That is just behind DeepSeek 4.1 Flash, a 552B model, and far above Mistral Large 3 (December 2025), which scored 9. He describes it as not frontier-class, but roughly six months behind the frontier. This is one commentator's reading of one index, not an independent security evaluation.

Why a security team should care

Nothing in the announcement is a vulnerability. The relevance is operational. A capable model with downloadable weights changes who is responsible for running it safely.

Open weights shift responsibility to you

With a hosted API, the provider operates the serving stack and any moderation or filtering layers. Once you self-host weights, you own the inference infrastructure, access control and logging. You also own the system prompts, tool permissions and output filtering around the model. Those are the layers where prompt injection and excessive-agency problems, as catalogued in the OWASP LLM Top 10, tend to show up in practice.

Reasoning mode is part of the attack surface

The preview API offers only 'none' and 'high' reasoning levels. In Willison's informal test, the 'high' setting produced a better result while using fewer output tokens (2,717 versus 3,275). That is a single data point and says nothing about safety. It does show that a reasoning toggle can change output behaviour and cost. Jailbreak and injection testing done on one setting should not be assumed to transfer to the other.

Preview weights and final weights are different artefacts

The open-weights release is promised, not yet shipped. Anything evaluated through the preview API is a proxy for the eventual download. Quantisation, chat templates, serving configuration and any changes between preview and release can all alter behaviour. Re-run your evaluations against the artefact you actually deploy.

A practical checklist before adopting

• Verify provenance: download weights only from the publisher's official channel and check published hashes where available. Treat look-alike repositories as a supply-chain risk.
• Test per configuration: run prompt-injection, data-exfiltration and tool-abuse tests for each reasoning level, quantisation and system-prompt variant you plan to ship.
• Constrain agents: apply least privilege to any tool or credential the model can reach, whichever model sits behind it.
• Record it in your AI inventory: a new model is a change to your AI management system. Frameworks such as ISO/IEC 42001 expect documented risk assessment when models change.

Bottom line

The headline numbers are about scale and catching up with the frontier. The security-relevant fact is the promised open-weights release. When it lands, the people who deploy the model, not Mistral, decide how safe it is in production. Plan the evaluation work now, so it is ready when the weights are.