Mistral has released improved Large 4 weights, giving teams a way to run and modify its roughly one-trillion-parameter model on infrastructure they choose. The release brings substantial control over deployment, alongside a commercial licence condition that extends to affiliates and serving requirements that need careful sizing.
The public weight release dates to 29 October 2026, as recorded in the initial Hugging Face release commit. It follows the 6 October public preview still listed in Mistral’s model documentation. Mistral says the downloadable model received additional reinforcement learning after that preview.
For teams considering private deployment, the useful questions are what they can download, which commercial uses the licence permits and what they will have to operate themselves.
What teams can download and change
The public model, nicknamed Le Chonk, is available in official FP8 and NVFP4 repositories. These contain the learned weights, configuration and tokenizer needed by compatible serving software.
Large 4 accepts text and images and produces text. It offers low, medium and high reasoning levels, with high the default. Its mixture-of-experts architecture activates about 52 billion parameters per token, including embeddings and output layers, from roughly one trillion parameters in total. Sparse activation reduces the computation needed for each token; operators still need to accommodate the model’s full weights.
The model card advertises a native context window of 1,048,576 tokens. Whether a deployment can serve that length, and how many requests it can handle alongside it, depends on the hardware, serving engine and memory allocation.
“Open-weight” describes this release accurately. The weights are available to inspect, modify, further train and deploy under the licence. That availability does not establish full training-data transparency or unrestricted open-source rights.
The commercial condition reaches beyond hosting this model
The Mistral Ecosystem Open-Weight License describes itself as modified MIT. It grants broad rights to use, copy, modify, distribute, sell, run and further train the model, subject to its conditions. Copies or substantial portions must retain the copyright and permission notices.
Its central commercial condition deserves a close reading: if the licensee or any affiliate operates a Model as a Service business, the licensee must obtain a separate commercial licence from Mistral before using the model or derivatives for any commercial purpose, subject to section 3’s exceptions. The trigger is broader than charging customers for a Large 4 API.
The licence defines Model as a Service as giving third parties access to the model or derivatives for inference or post-training, by any means, while allowing meaningful control over inputs, parameters or training data. It excludes end-user products whose model capabilities are solely embedded within specific features or harnesses, and services that merely relay requests to models hosted by others.
Section 3 then exempts:
- Internal use, defined as use that does not make the model or derivatives available to third parties.
- Use of the model through Mistral’s official products.
An embedded feature may fall outside the MaaS definition, but that alone does not resolve an affiliate’s separate MaaS business triggering the condition. Teams need to check the whole arrangement against both the definition and the exceptions. The licence contains no numerical revenue threshold.
These conditions make “ordinary MIT” an inadequate shorthand. They also matter when comparing a company running an internal assistant with a group that sells model services through another subsidiary.
Serving examples vary with precision and workload
The release is large enough that weight precision materially changes deployment planning. FP8 uses mixed precision; the Blackwell-targeted NVFP4 version further compresses the mixture-of-experts weights while keeping other linear layers in FP8.
The vLLM serving recipe gives approximate weight sizes of 1.06 TB for FP8 and 610 GB for NVFP4. Those are source estimates for weights, before the additional memory required by the runtime and the key-value cache used during inference.
Published configurations illustrate different operating choices:
| Source | Hardware and precision | Context and workload conditions |
|---|---|---|
| vLLM recipe | Four GB300 GPUs in an NVL4 configuration, NVFP4, tensor parallelism across four GPUs | Rendered configuration sets 262,144-token maximum context, 128 maximum sequences, 85% GPU memory utilization and three-token DSpark speculative decoding. |
| Hugging Face integration report | Eight H200 GPUs, FP8, vLLM with tensor and expert parallelism plus DSpark | Reports 131K context and up to 16 requests. |
| SGLang cookbook | Eight B300 GPUs, FP8, tensor parallelism across eight GPUs | Its published speed test uses 1,024-token random prompts, 512 generated tokens and 64 requests per concurrency point, with cache flushed. This measures that workload rather than million-token serving. |
These are documented examples and source observations, not measurements reproduced for this article. A maximum-sequence setting does not imply that every sequence can simultaneously consume the maximum context.
The Hugging Face model card includes eight-way serving examples, while the SGLang cookbook also verifies a four-GB300 NVFP4 configuration. Hugging Face’s eight-H200 report differs from vLLM’s documented 16-H200 FP8 configuration. Together, these sources establish several routes to serving the model; they do not establish a universal eight-GPU minimum.
For implementation, the dedicated model images are the clearest documented starting point. The vLLM recipe currently conflicts with itself: its generated installation section names version 0.34.0 or later, while background prerequisites say support requires the dedicated image. Teams should resolve that discrepancy before relying on a generic installation command.
Private deployment gives the operator more decisions to own
Mistral’s announcement presents local deployment and customization as central benefits. Downloadable weights let a team run inference without Mistral’s serving API and choose its own infrastructure and model modifications.
In practice, self-hosting puts decisions about data location, access, logging, connected tools and updates with the operator. It also leaves that operator responsible for accelerator capacity, serving patches, availability and evaluating the model in its application. Residency and tool permissions depend on the surrounding system’s configuration.
Managed routes include Mistral’s own services and third-party hosting. Hugging Face documents an Inference Endpoints integration, while Mistral lists Microsoft Foundry private Azure deployment options among its distribution routes. Each service still needs a check of region, retention, access controls, private-network options and contractual terms. A hosted endpoint’s privacy properties follow from those arrangements.
The cyber scores do not establish a safe deployed agent
Mistral markets Large 4 for defensive security as well as coding. It reports a 96.6% average refusal rate on cyber prompts from JailbreakBench, StrongREJECT and AgentHarm, and 97.1% resistance on B3, which it connects to prompt exfiltration and code injection.
Those are vendor-reported results. The announcement does not provide enough detail about prompt counts, weighting, attack budgets or judging to reproduce them, and the full technical report was still described as forthcoming when checked on 31 October. The figures were not independently verified for this article. A refusal average on selected tests cannot be read as the share of all malicious requests that a deployment will block.
Mistral also acknowledges potential uplift for real attacks and says it is modifying guardrails. Its separate specialized cyber variant is a preview for vetted enterprise design partners, including Orange Cyberdefense, with contractual safeguards and use limited to owned or explicitly authorized systems in controlled environments. The public weights should not be confused with that partner offering.
For a private deployment, evaluation therefore needs to cover the actual tools, permissions, data and attack paths of the intended application. A model’s resistance score cannot establish the security of an agent that can read files, execute code or reach internal services.