Mistral Large 4 deploys 133 agents to find and patch a Django vulnerability

Mistral AI pointed its new Large 4 model at a real security flaw and let it work. The model used 133 agents to find, verify, and patch a recent vulnerability in the Django web framework.

What Mistral actually showed

The demonstration was released on November 4, 2026. Mistral presented it as an end-to-end run, covering everything from first discovery to a finished fix.

The 133 specialized agents split the work among themselves. Some mapped the codebase. Others located the flaw, simulated attacks against it, reproduced the issue, and generated a patch.

Security teams call this sequence triage, reproduction, and patching. Put simply, the model figures out what is broken, proves the problem is real, and then fixes it.

Mistral shared the run as a time-lapse video sped up to 90x.

The model goes by Mistral Large 4, though it also carries the nickname “Le Chonk.”

The test target was not hypothetical. Django had shipped its own security updates on November 3, 2026, one day before the demonstration came out.

Those updates addressed several CVEs, including memory exhaustion and log injection vulnerabilities. Mistral’s demo drew on that freshly patched batch, giving the model a recent, real-world flaw to chew on.

Memory exhaustion bugs can let an attacker overwhelm a system’s resources. Log injection flaws can let bad actors tamper with the records administrators rely on to understand what happened on their servers.

Open weights and a guardrail number

The Django run was not the first time Mistral talked up Large 4’s security chops. The company opened the model’s weights on October 30, ahead of the demonstration.

Opening the weights means anyone can download the model and run it on their own hardware.

At that release, Mistral emphasized the model’s strengths in identifying and remediating vulnerabilities. It also flagged a safety figure: a refusal rate of over 96% against malicious cyber prompts during benchmarking.

That number matters because the same skills that patch a bug can also exploit one. A model that can map a codebase and simulate attacks is, by definition, a model that knows how to attack.

Mistral’s pitch is that Large 4 says no to the bad requests while saying yes to the defensive ones. Over 96% refusal on malicious prompts is the company’s evidence for that claim.

Why the multi-agent approach is the real story

The headline figure is 133 agents, and it says something about where AI security tooling is heading. Rather than one model doing everything, the work gets broken into specialized roles that coordinate.

This structure is known as multi-agent orchestration. Mistral used the Django demo to argue that coordinating many focused agents can handle the full vulnerability lifecycle, not just isolated steps.

What this means for security teams and the AI market

The timing of the demo is worth noticing. Django published fixes on November 3, and Mistral showed its model handling that territory on November 4.

The open-weight decision complicates the competitive picture in useful ways. Companies wary of sending proprietary code to an outside API can, at least in principle, run Large 4 on their own infrastructure.

On the market side, the research behind this story suggests the demonstration may lift sentiment toward AI and cybersecurity firms. It also notes the result could encourage more venture capital to flow toward AI-driven security technology.

Mistral is positioning Large 4 as a leading tool for automating the vulnerability lifecycle.