Open-weight MoE’s defense dividend: Mistral Large 4’s reproduce-then-patch scores pull security tooling off closed APIs

On 29 October 2026 Hugging Face published a post announcing Mistral Large 4—also called Le Chonk—on the Hub. The model takes text and images and emits text. It has about 1T total parameters, about 49B active, a 1M-token context window, and ships in official FP8 and NVFP4 variants, with community GGUFs alongside. The license is the Mistral Ecosystem Open-Weight License, an MIT derivative that adds limits for model-as-a-service offerings.

The parameter counts are familiar. What changes the operational division of labor is the cybersecurity frame: on the Artificial Analysis Cyber Index task that asks a model to reproduce a real vulnerability in open-source software and then patch it, Large 4 scores 82%. The post says several closed frontier models score near zero because they refuse to attempt the work. The falsifiable claim is narrow: when defense work depends on a reproduce–analyze–patch evidence chain, an open-weight frontier MoE with strong reproduce-then-patch scores pulls security tooling off closed APIs that refuse the same investigation steps, because both usage policy and deployment sit under the user’s control.

The post describes Large 4 as a large expert pool plus sparse attention plus a Pixtral vision encoder. The text decoder has 72 layers, hidden size 6144, and 64 attention heads. Attention blocks combine Multi-head Latent Attention (MLA) with a DeepSeek Sparse Attention (DSA) indexer: MLA keeps a compressed KV state; DSA selects up to 2,048 prior positions per query. Decoder blocks follow a 3:1 RoPE-to-NoPE pattern and share KV across layers. The first layer uses a dense FFN; the other 71 use MoE—softmax routes four of 128 experts, plus one always-on shared expert, for five active experts per token. Vision is a 1.6B Pixtral encoder (30 layers, hidden 2048, 16 heads, 14×14 patches, spatial merge 2).

Those are checkable sparsity choices: expert sparsity for compute, position sparsity for long context. Day-0 support covers Transformers, vLLM, and llama.cpp; the Hub collection, Inference Endpoints (an 8×H200 recipe), and Dell Enterprise Hub recipes ship with the release. Example model IDs include mistralai/Mistral-Large-4-1T-A52B and its NVFP4 twin.

The benchmark section names concrete numbers. As of 29 October 2026, Large 4 ranks fifth among open-weight models on the Artificial Analysis Intelligence index. Its combined Coding Agent Index is 49.8%, ahead of DeepSeek V4 Pro 0813 and Qwen3.8 Max as cited; component scores include DeepSWE v1.1 61.7%, SWE-Atlas-QnA 59.4%, and Terminal-Bench 4 28.3%. Knowledge-work figures include AutomationBench 59.9% and AA-Briefcase Elo 1,393.

Cybersecurity is the headline capability: 82% on the AA Cyber Index reproduce-then-patch task (described as among the highest reported on that subtest, with a global top-five placement on the broader index); 93% on a 40-challenge Cybench suite; 93.3% attack resistance on Lakera’s B3 prompt-injection benchmark. Internal testing also mentions malware analysis, vulnerability prioritization, and detection-rule writing—explicitly not tasks the model was specially trained for. At the same time, average refusal on cyber-flavored prompts from JailbreakBench, StrongREJECT, and AgentHarm is higher than for other open-weight models: open weights are not “yes to everything.”

Evidence ceilings matter. The “closed models near zero” contrast is reported in the post, not independently re-run here. Internal security anecdotes lack public samples and baselines. MaaS license limits constrain who can resell the weights as a public API; they do not block self-hosted defense pipelines. Fact confidence: high for architecture and published leaderboard numbers; medium-high for “closed APIs are unusable for reproduce chains,” which depends on each provider’s live policy; medium-low for “every security team should abandon closed APIs immediately.”

Steelman: closed-API refusal shrinks the attack surface of abuse. Releasing a high-capability reproduce-vulnerability model as open weights hands the same capability to attackers and defenders. The post positions the model for defense and answers with higher jailbreak refusal rates. But averages are not guarantees on your codebase, crash logs, and malware corpus; after self-hosting, the policy is yours—and so is misconfiguration.

Second steelman: a ~49B-active / 1T-total MoE is still heavy for many security teams. llama.cpp 2-bit quants can run on a single high-memory Apple Silicon box, but long-context throughput falls; production NVFP4/FP8 usually wants multi-GPU expert parallelism. If the job is “ask how to fix one bug,” a paid closed model plus human reproduction may be cheaper—until an incident is interrupted by an API cutover or a filter that blocks the reproduce step.

For SOC, vulnerability research, and incident response, the argument shifts from “which chat model is smarter” to “can the reproduce chain finish on weights you control.” Open weights let teams build systems around their own code, crash logs, and malware samples, and use tools such as TRL to distill smaller security models from Large 4 patching traces—reproduce-then-patch carries a verifiable reward suited to RL environments. For vendors and integrators tied to a single closed gateway, that is product pressure: if defense workflows systematically fail at investigation steps, buyers will move critical paths onto self-hostable weights.

For the open-source community, day-0 inference and fine-tune support lowers the “labs only” barrier. For auditors and red teams, refusal behavior can be measured directly instead of trusting a provider write-up. The MaaS clause is a reminder that open weights are not a frictionless public hosting market.

Over the next six months, watch three things: whether independents reproduce the AA Cyber Index closed-model contrast; how many defense teams move reproduce–patch pipelines onto self-hosted open weights and test API interruption and refusal in live incidents; and whether Jailbreak/AgentHarm-class refusal stays higher than peer open models after fine-tuning and tool use. If reproduce chains run reliably on open weights and still systematically break on closed APIs, the “open MoE defense dividend” holds. If closed providers open investigation-class tool use, or abuse of open weights dominates the story, the claim needs rewriting.