About Mistral Large 4
Mistral Large 4 is a large language model from Mistral AI, the French AI lab. It came out as a public preview on October 6, 2026, and the final version with open weights followed on October 29, 2026. Its nickname is Le Chonk. It replaces Mistral Large 3 from December 2025
It is a mixture-of-experts model with about 1 trillion parameters, 49 billion of which work on each token. It was trained from scratch in Mistral's own data centers in Europe. It reads text and images, writes in more than 160 languages and has three reasoning levels: low, medium and high. The weights are on Hugging Face, so companies can run the model on their own servers
On Overchat AI, Mistral Large 4 is in the same chat as Claude, GPT, Gemini and other models, so you can switch to another model without starting a new conversation
- Developer
- Mistral AI
- Released
- Oct 29, 2026
- Parameters
- 1T total, 49B active
- Context window
- 1M tokens
- Input
- Text, images
- Weights
- Open, on Hugging Face
See how Mistral Large 4 answers
Review this Flask route for security problems. Name the vulnerability, explain in one sentence how someone could exploit it, and give me the fixed code. @app.route("/download") def download(): name = request.args.get("file") return send_file(os.path.join("/srv/reports", name))
Vulnerability: Path Traversal (Arbitrary File Read) — CWE-22
os.path.join("/srv/reports", name) does no validation, so ../ sequences escape the directory — and worse, os.path.join discards the base entirely if name is an absolute path.
Exploit (one sentence): An attacker can request /download?file=../../etc/passwd — or simply /download?file=/etc/passwd, since the absolute path overrides the join — to read any file the Flask process can access, such as /etc/passwd, .env secrets, database credentials, or application source code.
Fixed code
import os
from flask import abort, request, send_file
from werkzeug.utils import safe_join
REPORTS_DIR = os.path.realpath("/srv/reports")
@app.route("/download")
def download():
name = request.args.get("file", "")
if not name:
abort(400)
# safe_join returns None for "../" traversal AND absolute paths like /etc/passwd
path = safe_join(REPORTS_DIR, name)
if path is None or not os.path.isfile(path):
abort(404)
# realpath + commonpath also blocks symlinks planted inside REPORTS_DIR
real = os.path.realpath(path)
if os.path.commonpath([real, REPORTS_DIR]) != REPORTS_DIR:
abort(404)
return send_file(real, as_attachment=True)If you don't need the extra symlink defense, the simplest correct fix is send_from_directory, which uses safe_join internally and returns 404 on traversal:
from flask import send_from_directory
@app.route("/download")
def download():
name = request.args.get("file", "")
return send_from_directory("/srv/reports", name, as_attachment=True)Extra hardening worth adding
as_attachment=True(shown above) forces a download instead of rendering the file in-browser, preventing XSS if a report ever contains HTML/JS.- Whitelist extensions (e.g. only
.pdf,.csv) so users can't fetch.py,.env, or config files even inside the directory. - Rate-limit the route — arbitrary-file-read endpoints are also useful for brute-forcing filenames.
- Note the original also 500s when
fileis missing (os.path.joinwithNone); theabort(400)handles that.
Write a short note to our hotel guests in French, German and Spanish: the pool is closed for repairs on November 12 and 13, breakfast moves to the terrace on those days, and the spa stays open. Friendly, two sentences per language
Français
Chers hôtes, la piscine sera fermée pour travaux les 12 et 13 novembre et le petit-déjeuner sera servi sur la terrasse ces jours-là. Notre spa reste ouvert comme d’habitude et nous vous souhaitons un agréable séjour !
Deutsch
Liebe Gäste, das Schwimmbad ist am 12. und 13. November wegen Reparaturarbeiten geschlossen und das Frühstück wird an diesen Tagen auf der Terrasse serviert. Unser Spa bleibt wie gewohnt geöffnet und wir wünschen Ihnen einen angenehmen Aufenthalt!
Español
Estimados huéspedes, la piscina estará cerrada por reparaciones los días 12 y 13 de noviembre y el desayuno se servirá en la terraza esos días. Nuestro spa permanece abierto como de costumbre y les deseamos una estancia muy agradable.
Explain this clause from my freelance contract in plain words. Then tell me what risk it puts on me and one change I could ask for. "The Contractor shall indemnify and hold harmless the Client against any and all claims, losses and expenses, including legal fees, arising out of or in connection with the Services, without limitation as to amount"
(Note: I'm not a lawyer, and indemnity laws vary by jurisdiction — worth having an attorney review your full contract. But here's what this clause means in everyday terms.)
In plain words
You're promising to pay the client back for any claim, loss, or expense — including their legal bills — that is connected in any way to the work you did. "Hold harmless" adds that you also can't sue the client over that same issue. And "without limitation as to amount" means there's no ceiling — you could owe far more than you were paid for the project.
Breaking it down:
- "Any and all claims, losses, expenses, including legal fees" = everything, with no exceptions listed
- "Arising out of or in connection with the Services" = a very broad trigger. Anything even loosely tied to your work counts
- "Without limitation as to amount" = unlimited liability
The risk it puts on you
- Unlimited exposure: A lawsuit related to your work — even one where you're only partly at fault — could cost more than the entire project fee and reach your personal savings or assets.
- You pay for the client's own mistakes: Because of the broad "in connection with" language, you could end up covering problems caused by the client's negligence, or changes they make after you deliver the work.
- Legal fees regardless of outcome: You'd cover the client's lawyers even if the claim is weak or you ultimately win.
- One-sided: Only you owe this protection; the client owes you nothing similar.
- Insurance gap: Your professional liability insurance may not cover liability you voluntarily assumed in a contract like this.
One change to ask for
Put a cap on it. Ask them to replace "without limitation as to amount" with something like:
"provided that Contractor's total liability under this clause shall not exceed the total fees actually paid to Contractor under this Agreement."
This makes your worst-case exposure equal to what you were paid for the job — a standard, reasonable limit.
If you can negotiate further, also consider narrowing the trigger from "arising out of or in connection with the Services" to "caused by Contractor's negligence or willful misconduct," so you're not on the hook for things you didn't cause.
More prompts to try with Mistral Large 4
Mistral Large 4 vs other models
The same tests on every model, plus speed, open weights and hallucination rate, one rival at a time
| Spec | Mistral Large 4 | GLM-5.3 |
|---|---|---|
| Developer | Mistral AI | Z.ai |
| Released | Oct 29, 2026 | Aug 18, 2026 |
| Context window? | 1M tokens | 1M tokens |
| Output speed? | 161 tokens/s | 72 tokens/s |
| Input | Text, images | Text |
| Open weights? | Yes | Yes |
| Hallucination rate? | 28% | 39% |
| Spec | Mistral Large 4 | DeepSeek V4.1 Flash |
|---|---|---|
| Developer | Mistral AI | DeepSeek |
| Released | Oct 29, 2026 | Oct 17, 2026 |
| Context window? | 1M tokens | 1M tokens |
| Output speed? | 161 tokens/s | 179 tokens/s |
| Input | Text, images | Text, images |
| Open weights? | Yes | Yes |
| Hallucination rate? | 28% | 64% |
| Spec | Mistral Large 4 | Kimi K3.1 Pro |
|---|---|---|
| Developer | Mistral AI | Moonshot AI |
| Released | Oct 29, 2026 | Oct 23, 2026 |
| Context window? | 1M tokens | 1M tokens |
| Output speed? | 161 tokens/s | 35 tokens/s |
| Input | Text, images | Text, images, video |
| Open weights? | Yes | Not yet |
| Hallucination rate? | 28% | 37% |
| Spec | Mistral Large 4 | Muse Spark Open |
|---|---|---|
| Developer | Mistral AI | Meta |
| Released | Oct 29, 2026 | Oct 15, 2026 |
| Context window? | 1M tokens | 1M tokens |
| Output speed? | 161 tokens/s | 141 tokens/s |
| Input | Text, images | Text, images, video, audio |
| Open weights? | Yes | Yes |
| Hallucination rate? | 28% | 28% |
| Spec | Mistral Large 4 | GPT-6 Luna |
|---|---|---|
| Developer | Mistral AI | OpenAI |
| Released | Oct 29, 2026 | Sep 22, 2026 |
| Context window? | 1M tokens | 1M tokens |
| Output speed? | 161 tokens/s | 122 tokens/s |
| Input | Text, images | Text, images, files |
| Open weights? | Yes | No |
| Hallucination rate? | 28% | 79% |
| Spec | Mistral Large 4 | MiniMax M3.1 Flash |
|---|---|---|
| Developer | Mistral AI | MiniMax |
| Released | Oct 29, 2026 | Oct 19, 2026 |
| Context window? | 1M tokens | 1M tokens |
| Output speed? | 161 tokens/s | 118 tokens/s |
| Input | Text, images | Text, images, video |
| Open weights? | Yes | Yes |
| Hallucination rate? | 28% | 94% |
Sources: Artificial Analysis, Mistral Large 4 (Oct 29, 2026), Mistral AI, Mistral Large 4 (Le Chonk) is now open weight, Mistral AI, Mistral Large 4 model card
Mistral Large 4 main features
Security reviews, coding with fewer tokens, writing in 160+ languages, and long documents and images in a 1M-token context
Security code review
Mistral Large 4 is built for defensive security work. Paste a function or a whole file, and it names the vulnerability, explains how it could be exploited and writes the patch. It scores 51% on the Artificial Analysis Cyber Index, ahead of Kimi K3 at 41% and GLM-5.3 at 36%. It helps you find and fix holes in your own code and turns down requests to break into other people's systems
Coding with fewer tokens
Mistral Large 4 writes, reviews and fixes code and works through multi-step coding tasks. On the Artificial Analysis Coding Agent Index it scores 48%, one point behind GLM-5.3, while using 47% fewer tokens per task. It is also fast: about 161 tokens per second once the answer starts
Writing in 160+ languages
Mistral Large 4 writes fluently in more than 160 languages, including every official language of the European Union. Ask it to translate a page, answer a customer in their own language or write one message in several languages at once
Long documents and images
Mistral Large 4 explains contract clauses in plain words, checks spreadsheets and sums up reports. Its context window holds about 1 million tokens, so a long contract, a report and the whole chat fit at once. It also reads images: screenshots, charts, scanned pages and technical drawings
Why use Mistral Large 4 on Overchat AI
One account for chat, images and video, on every device
Superchat AI agent
Superchat Agent automatically routes your message to the model best suited for the task. It can generate images and videos, use the AI tools built into Overchat AI, and learn from your interactions to get better over time
Chat with images and files
Upload PDFs, spreadsheets, code and screenshots and ask Mistral Large 4 about them. You can also dictate a message instead of typing it
Go beyond text
Generate images with Nano Banana and GPT Image and videos with Seedance and Kling in the same account, with the same credits as chat
On the web, iPhone and Android
Start a chat on your laptop and finish it on your phone. The Overchat AI app has the same models, and your chats stay in one account on every device
How to use Mistral Large 4 on Overchat AI
Start in the chat at the top of this page or in the Overchat AI app on the web, iOS or Android
- 01
Pick Mistral Large 4
It is already picked in the chat on this page. In the Overchat AI app, open the model list next to the message field and choose Mistral Large 4
- 02
Paste code or attach a file
Paste your code or add a document, a spreadsheet or a screenshot, and write what you need: the format, the length and what to check first
- 03
Keep going in the same chat
Ask a follow-up, ask for a shorter version or the answer in another language, or switch to another model without losing the conversation
Explore other models
Models marked Soon are coming to Overchat AI; the rest are available now
Learn more about Mistral and open models
ChatGPT vs Mistral AI: Features, Pricing and Performance
Which is better, ChatGPT or Mistral? We break down what actually matters: how they work, what they cost and which one fits your needs better
Local LLM Hardware Requirements in 2026
What hardware do you need to run a local LLM in 2026? GPU, VRAM, RAM and CPU requirements for every model size, from 3B to 400B
Ollama vs LM Studio: Best Local AI App in 2026
We compare Ollama, LM Studio and Atomic Chat to find out which local AI app is the best
Mistral Large 4 FAQ
If you have any questions,
reach out to us at hello@overchat.ai
Mistral Large 4 is the largest model from Mistral AI, released with open weights on October 29, 2026. It is a mixture-of-experts model with about 1 trillion parameters, 49 billion of them active for each token. It reads text and images, writes in more than 160 languages and has a context window of 1 million tokens
Le Chonk is the official nickname of Mistral Large 4. It comes from a cat meme: “chonk” is internet slang for a big, round cat, a joke about a model with 1 trillion parameters
Mistral Large 4 came out as a public preview in the Mistral API on October 6, 2026. The final version and the open weights followed on October 29, 2026, after three more weeks of training. It replaces Mistral Large 3, released in December 2025
Its weights are open: anyone can download them from Hugging Face. The license is the Mistral Ecosystem Open-Weight License, a modified MIT license. It allows commercial use, fine-tuning and running the model on your own servers. Companies that sell access to the model as an API service need a separate license from Mistral
The weights are free to download, but running a 1-trillion-parameter model takes a server with eight data center GPUs. On Overchat AI you can chat with Mistral Large 4 in the browser or the app without any hardware: it is in the model list next to Claude, GPT and Gemini
About 1 trillion in total (1.05 trillion), of which 49 billion are active for each token, or 52 billion counting the embedding and output layers. The model has 128 experts, 4 of which work on each token, plus one shared expert. The vision encoder adds 1.6 billion parameters
It is the strongest open-weight model from the US or Europe on the Artificial Analysis Intelligence Index: 26 points against 24.7 for Meta's Muse Spark Open. The leading open models from China score higher, with 31.7 for GLM-5.3 and 32.5 for DeepSeek V4.1 Flash. Mistral Large 4 is strongest at security work, coding with few tokens and writing in many languages, and it has a low hallucination rate of 28%
Mistral Large 4 takes about 1 million tokens of context (1,048,576), roughly 750,000 words. Its answers can be up to 262,144 tokens long, reasoning included
Yes, with enough hardware. The full model runs on a server with eight GPUs through vLLM or SGLang, and a smaller NVFP4 version is made for NVIDIA Blackwell GPUs. There are GGUF files for llama.cpp too, but even compressed the model needs hundreds of gigabytes of memory. For most people, the chat on Overchat AI is the easier way to use it
Type your message in the chat at the top of this page, attach a file or paste your code if you need to and press Send. After you sign in, Mistral Large 4 answers in the Overchat AI chat, where you can keep the conversation going on the web, iOS or Android and switch to another model at any time
