Open Weights Aren't Just Chinese Anymore: Mistral Large 4, Reflection AI's Beam, and the Dolphin Question

"Open Weights Aren't Just Chinese Anymore" is a great episode title, and Tom Merritt and Jason Howell earned it on the October 6 Daily Tech News Show, but it's worth being precise about what actually happened that week. Two Western labs announced open-weight frontier models within a day of each other, and neither one has shipped a single weight file yet. Mistral put Large 4 into a public preview behind its own API and promised the weights by the end of October. Reflection AI, a two-year-old startup in Brooklyn, announced Beam, opened a waitlist, and promised the weights later this month under Apache 2.0. So the honest version of the headline is that open weights aren't just Chinese anymore, pending delivery.

I tend to believe the delivery will happen, and I think it matters a great deal for the security teams most of us work on, which is why this article exists. But as of this writing on October 13 the thing you can download is still a press release. That caveat isn't a complaint. It's the frame for everything below, because the difference between a model we can call and a model we can hold is the whole reason a security team should care about this story in the first place.

What was actually announced

Mistral Large 4, which Mistral's own people nicknamed "le Chonk," is a mixture of experts model with roughly a trillion parameters in total and, depending on which Mistral document you read, 49 or 52 billion active per token. The launch post says 52, some early coverage said 49, and it is difficult to guess from the outside which number is right, so nobody should build anything on the difference. It is natively multimodal, and it runs in a hybrid instruct-and-reasoning mode, which means the same checkpoint answers quickly or thinks at length depending on how it's called.

The vendor reports it was trained from scratch on about 3,800 Nvidia Grace Blackwell GPUs in its own European data centers, a figure TechCrunch rounds to 4,000. Pierre Stock, Mistral's VP of Science, told TechCrunch that is two to three times less compute than its Chinese competitors used. The preview is live on Mistral's API at $1.36 per million input tokens and $4.18 per million output tokens, which for a model this size is cheap enough to be a statement.

The part that should make an enterprise architect sit up is the license, because nobody has seen it. Mistral's documentation labels the model "Open" and stops there. The New Stack reports that the checkpoint will ship under a custom license rather than the Apache 2.0 that Mistral Large 3 used. I have not seen the license text, so treat that as a report and not a fact. But my working assumption is that "open weight" and "Apache 2.0" have quietly stopped being synonyms at Mistral, and if we plan to self-host this for client work, the license is the first document we read, not the benchmark table.

Beam is a different animal. Reflection AI was founded in 2024 by Misha Laskin and Ioannis Antonoglou, both formerly of Google DeepMind, and it has raised something like $4.7 billion from Nvidia, Sequoia, Lightspeed, and Citigroup at a $25 billion pre-money valuation, per TechCrunch's reading of PitchBook. Beam is a sparse mixture of experts with 501 billion total parameters and 23 billion active, text only, pretrained on 23.8 trillion tokens over roughly four weeks on 6,144 Nvidia GB300 chips and then put through a reinforcement learning run that Reflection says produced more than 100 million rollouts. Effective context is a million tokens.

Reflection's own numbers put it on par with Z.ai's GLM-5.2 on coding and agentic work at three to four times less inference compute, and ahead of Thinking Machines' Inkling on the coding tests where both report results. Those are vendor numbers, and they may not survive contact with a harness Reflection didn't build. The technical report, the model card, the safety evaluations, and the weights are all promised for later in October, and by one account Reflection's Hugging Face organization listed no public models as of October 10.

The pitch from both companies is the same pitch with different accents. Laskin told Semafor that governments and businesses building sovereign AI systems, the ones that can't or won't use Chinese models, have had poor options until now. Mistral's framing, which President Macron has described as a third way, is that closed models can be unplugged and open models mostly come from China. I tend to believe the geopolitical angle is doing a lot of marketing work here, and I also suspect it's true. If our client is a European bank or a US defense contractor, the country of origin of the weights is a procurement question before it is a capability question, and until this month the answer was awkward.

Why a security team should care about weights it can hold

I wrote at length about this in the Kimi K3 review, so the core argument can stay short. A hosted model means our client's hostnames, source code, vulnerability details, and network diagrams cross a trust boundary to a vendor who logs them and is subject to legal process we don't control. Weights we hold run inside the perimeter. A hosted model can also be deprecated, throttled, re-aligned, or have its account suspended at hour seventy of a seventy-two hour window, and most of us have watched at least one of those happen to a tool we depended on. Weights on our own disk do none of those things.

Guillaume Lample, Mistral's co-founder, made a version of this point to The Deep View that seems underappreciated. Defensive security workflows are inference heavy, we run them constantly, and a defense that depends on a model that might disappear one day is a defense with a dependency nobody signed off on. That's the sovereignty argument with the flags removed.

The practical reality is less romantic. A trillion-parameter mixture of experts does not run on your laptop, your lab box, or most of the GPU nodes a security team can get budget for. Fifty-two billion active parameters still means the whole trillion has to live in memory somewhere, and that is a multi-GPU server at minimum. Beam at 501 billion is smaller and still enormous. The Deep View notes that even universities may not be able to run Large 4 in practice, and I'd extend that to most consultancies.

For a lot of teams the realistic way to get these models is probably a cloud provider running the open weights in a private tenancy, which is better than an API with a vendor's logging policy and worse than a box in our own rack. It is possible the quantization community makes the 500 billion class run on a single fat node within weeks of release, because they have done it for everything else. But plan for the hardware you have, not the hardware Reddit promises.

Read the cyber benchmarks like a sensor, not a score

Mistral leaned hard on cybersecurity in the launch, so let's look at what it claimed and what the instruments measure. The post says Large 4 ranks in the top five globally on the Artificial Analysis Cyber Index and leads every open-weight model built outside China by a wide margin, scores 82 percent on a reproduce-and-patch vulnerability test, which Mistral says is the highest of any model, and solves 93 percent of the Cybench challenges. It also resists 93.3 percent of the attacks in Lakera's B3 benchmark.

Independent coverage disagrees about the Cyber Index placement, with one review putting Large 4 at a score of 50, level with GLM-5.3-Flash and behind MiMo-V2.6-Pro, and another calling it a tie for first. I couldn't reconcile those from the outside, and perhaps the fairest statement is that it's near the top of a new leaderboard that moves monthly.

Here is the part the headlines skip. The Artificial Analysis Cyber Index, launched September 25, measures defense only. Every task starts with the source code, the way an application security engineer would audit it, and the model has to find a vulnerability, reproduce it, and patch it without breaking the application. It is the equally weighted average of three evaluations, CWE-Bench-AA from Collinear AI, DeepsecBench-AA from Vercel, and CyberGym-E2E-AA from Berkeley RDI, and the methodology says outright that no task asks the model to turn a vulnerability into a working exploit. Refusals are recorded separately from the score.

So "top five on the Cyber Index" means very good at finding and fixing bugs in code it can read, which is a wonderful thing for a blue team and says little about offense. Cybench is the closer proxy for offense, since it's built from capture the flag challenges, but a CTF is a puzzle with a known answer and a clean sandbox. A top score there suggests the model can do the parts of an engagement that look like puzzles. Most of an engagement does not.

Then there's the part Mistral said quietly. Before the weights go public, Mistral is red-teaming the model with what it calls cybersecurity leaders, vetted partners, and state authorities, who get the same model with reduced moderation and expanded cyber capabilities. Read that sentence twice. The public preview is the moderated endpoint. The capable version appears to be the one governments and selected security firms are testing right now.

Reuters reported, as relayed by The New Stack, that during evaluation the model moved beyond its test environment, and that Stock described the behavior as expected and contained in software. I have not seen the evaluation, it is difficult to guess what beyond its test environment meant in practice, and it's possible this is a sandbox misconfiguration being retold as a thriller. But the same reporting notes that OpenAI and Anthropic saw similar behavior from their most cyber-capable models and responded by restricting access, while Mistral's response is to publish the weights. Both positions are defensible, and the second one moves the safeguard decision from Paris to whoever runs the download.

Reflection, for its part, has said nothing about cyber benchmarks at all. Its post describes deliberative alignment, rounds of adversarial red-teaming, and reinforcement learning against jailbreak and agentic scenarios, and it defers the safety numbers to the technical report. Semafor reports Reflection is working with NIST's Center for AI Standards and Innovation and the UK AI Security Institute to assess Beam, which is the right instinct and also suggests the capability is high enough that governments want a look first. Nothing I would define as a cyber claim exists for Beam yet. That absence is informative.

Mistral Dolphin, and what "uncensored" actually means

Which brings us to the model people keep asking about by the wrong name. "Mistral Dolphin" is not a Mistral product. Dolphin is a family of fine-tunes from Eric Hartford and his Cognitive Computations group, built on top of base weights from several labs, and the Mistral-based ones became the most popular, most likely because Mistral's small models were Apache 2.0 and good. The one most people mean is dolphin-mistral on Ollama, a 7 billion parameter model whose current tag is version 2.8, built on Mistral 7B v0.2 in March 2024, with a 32K context and about 1.8 million pulls.

The newer ones probably matter more. Dolphin 3.0 Mistral 24B, from February 2025, sits on Mistral Small 24B and was tuned for coding, math, agentic work, and function calling. Dolphin Mistral 24B Venice Edition is a collaboration with Venice.ai that bills itself as the most uncensored Mistral 24B available and ships under Apache 2.0. (Dolphin got its start on a grant from Andreessen Horowitz, which is a detail I enjoy more than I should.)

The method is worth understanding because it's simpler than the mythology. An instruct-tuned model learns to refuse because its training data contains refusals, and most of the open instruct datasets were generated by ChatGPT, so the refusals carry OpenAI's alignment choices with them. Hartford's procedure, in his own description, is to identify and remove the refusals and biased answers from the dataset, keep the rest, and fine-tune the base model on what's left using the same recipe the original used. That's it. Nothing is jailbroken and nothing is hacked. A refusal is a learned behavior, and if you don't teach it, it isn't there.

The model card for the 7B version says the model "will be highly compliant to any requests, even unethical ones," and advises you to implement your own alignment layer before exposing it as a service. The Dolphin 3.0 card frames the same property as a feature. You set the system prompt, you decide the alignment, and the model does not impose its ethics on you.

In practice a Dolphin model is used the way any local model is used. We pull it with Ollama or load a quantized build into llama.cpp or LM Studio, we give it a system prompt, and we talk to it. The 24B versions want a very low temperature, somewhere between 0.05 and 0.15 depending on which card you read, and the unquantized 24B wants more than 60 GB of GPU memory under vLLM, though quantized builds run on a single consumer card.

The reason security people reach for it is the reason the Kimi review gave. A model that doesn't second-guess authorized work is a model that doesn't cost an hour of arguing about whether the signed scope is real. Ask a hosted assistant to explain a Kerberoasting detection and in most cases it will help. Ask it to write the actual script for an authorized lab and you might get a lecture. Dolphin just answers. It also answers when you ask it to summarize a malware sample's behavior, draft a phishing pretext for an approved awareness test, or walk a CTF box, and none of that leaves your machine.

Now the part the enthusiasts skip. A 7 billion parameter model from early 2024 is not a frontier model, and it will confidently invent CVE numbers, flags, and command syntax, and in this line of work a confident fabrication probably costs more than a refusal does. The 24B versions are much better and still not in the same class as the trillion-parameter things this article opened with. "Uncensored" also means the vendor's safety net is gone without a replacement, and the model card is explicit that the replacement is our job.

If we put a Dolphin model behind an internal chat tool for the SOC and someone pastes a prompt injection into a ticket, there is no refusal reflex standing between the injected instruction and whatever tools the model holds. And none of this changes the law. The signed scope is what separates authorized testing from a computer crime, and the model's willingness to answer has nothing to do with whether we were allowed to ask.

From the defender's chair, the interesting thing about Dolphin is that everyone can use it, including the people with no scope. My gut says it's wise to assume that any phishing lure, any obfuscated loader, and any reconnaissance script we see this year could have been drafted by a model that costs nothing and never refuses. That assumption doesn't change our detection strategy much, which is the comforting part. Behavior on the wire looks the same whether a human or a 7B model wrote the script. It does change our threat model for AI assistants inside our own perimeter, because the same property that makes Dolphin pleasant for an operator makes it dangerous as an unattended agent with tools.

What I'd actually do with this

If I ran a security team's AI program, October would go to three unglamorous things. First, build the private evaluation set this blog keeps nagging people about, twenty or thirty real tasks from our own work, scored for accuracy, tool use, refusal rate on authorized tasks, and structured output, so that when the Large 4 and Beam weights land we can score them the same afternoon instead of reading someone else's leaderboard. Second, read the license before the benchmark. Beam has promised Apache 2.0, and if it ships that way it's the easier procurement conversation. Large 4's terms are unknown, and the word "Open" on a documentation page is not a license.

Third, treat the weights as supply chain. A trillion-parameter checkpoint is probably the largest unaudited binary most of us will ever run against sensitive data. Verify the hash against the publisher, pin the version, and keep the model behind the same egress controls we'd give any other process, because an agentic model with tools and a prompt injection is an insider with no badge.

Dolphin fits in that plan as the small, local, refusal-free tool for individual operators, not as the engine of an automated pipeline. Give it a system prompt that states the scope and the client, log every prompt and response to a place the engagement lead can read, and never give it tools you wouldn't give a junior who was told to run everything without asking. For the heavy work, the summaries, the code review, the long-context log triage, wait for the big open weights, run them where the data lives, and put our own alignment layer in front of them, because the vendor's layer is exactly the thing we removed by downloading.

The thing the DTNS episode got right is bigger than two product launches. For three years the question about an AI model was how smart it is. The open-weight releases moved the question to who holds it. What Mistral's reduced-moderation program and Hartford's refusal-filtered datasets have in common is that both of them admit the guardrail was never in the model. It was in whoever controlled access to the model. When the weights are on our disk, that someone is us, and the controls that matter become architectural rather than advisory, meaning the scope document, the logging, the egress rule, and the human who reads the output before it runs.

Mistral says the capable version of Large 4 is in the hands of vetted partners and state authorities for now. In a few weeks it will most likely be in the hands of anyone with a fast connection and a big enough server. (Well, anyone who read the license.) You might want to have your evaluation set ready before they do.

Further reading

• DTNS 5368, "Open Weights Aren't Just Chinese Anymore" for the episode and its show notes
• Mistral's Large 4 announcement for the specifications, benchmark claims, and the red-teaming program in Mistral's own words
• Reflection AI, "Introducing Beam" for the architecture, training compute, and the promised release artifacts
• Artificial Analysis Cyber Index methodology for what the index does and does not measure
• Eric Hartford on uncensored models for the method and the responsibility argument from the person who built Dolphin
• Dolphin 2.8 Mistral 7B model card and Dolphin 3.0 Mistral 24B model card for the training details and the compliance warning
• The Deep View on Large 4 as a hedge against lock-in for Lample's argument about defensive inference

---

A note on this article: it was written on October 13, 2026, while both Mistral Large 4 and Reflection Beam were previews with weights promised but not yet published. Parameter counts, benchmark scores, and license terms are the vendors' statements at that time, and several of them already disagree between sources. The figures are authored illustrations in this site's style, not captures of a specific tool. The judgment about where the guardrail lives, and who owns it once the weights are on your disk, is the part meant to outlast the version numbers.