Mistral Large 4's 133-Agent Django Demo: It Reproduced a Bug Django Had Already Fixed

Mistral Large 4, the 1.05-trillion-parameter open-weight model Mistral AI nicknamed Le Chonk, was presented on 4 November 2026 as an end-to-end security researcher. A post from Mistral's official X account asked whether the model could "find a critical vulnerability, prove it and fix it," then answered with 133 agents, a Django codebase and a 90× time-lapse. The post names no CVE. It publishes no patch. It gives no runtime, no token count, no false-positive count and no link to a technical write-up.

The timing narrows the field. Django's security team had released fixes for six CVEs the previous day, 3 November 2026, in 6.1.3, 6.0.10 and 5.2.19 (one issue has no 5.2 patch listed). If that batch was the target — and it is the only Django CVE batch in the news that week — the demo cannot have discovered an unknown flaw, because all six were public and patched before the video was posted. It also was not a critical vulnerability. One carried a moderate rating; the other five were rated low.

That does not make the demo worthless. It makes it a workflow demonstration rather than a discovery claim, and the distinction matters for anyone deciding whether an open-weight model can take a place in a security team's triage queue.

What Mistral actually showed

The post is short: "Can Mistral Large 4 find a critical vulnerability, prove it and fix it? We tested it on a recent Django CVE. 133 agents map the code, hunt for flaws, test attack scenarios and confirm the bug. Then Le Chonk patches it. Triage, repro, patch. Shown at 90x speed." At the time of writing it had 540 likes, 94 reposts, 107 replies and about 21,000 views — a respectable product post, not a disclosure.

Mistral's own release notes describe the same workflow in more detail. The open-weight announcement lists a "Cyber Vulnerability Triage" agent that reads incoming vulnerability reports, reproduces the flaws in an isolated sandbox, writes and iterates on a patch, and continues "until a canary exploit no longer works." That is a documented feature of the model, written before the video. The 133-agent run is a public demonstration of it.

The 90× figure is a playback speed, not a result. Without the source video's length or the run's wall-clock time, it cannot be converted into a duration. A 90× time-lapse of a two-hour run and a 90× time-lapse of a two-day run look identical on a timeline.

The Django batch, and why "critical" does not fit

Django's 3 November advisory is unusually specific, which is what makes it useful as a control. It lists six issues, each with a CVE, a reporter, an affected branch set and a fix commit. The severities are not close to critical:

• CVE-2026-111362 — moderate. A GeoJSON geometry's crs member could make GDAL issue network requests or read local files during validation, saving or querying: an SSRF and local-file-read path.

• CVE-2026-108147 — low. Base64-encoded multipart uploads were buffered before upload handlers ran, bypassing FILE_UPLOAD_MAX_MEMORY_SIZE and allowing memory exhaustion.

• CVE-2026-111211 — low. Control characters in invalid geometry form values were logged without escaping, allowing log injection or forgery.

• CVE-2026-113593 — low. Missing and empty Vary header values produced the same cache key, risking exposure of private cached responses.

• CVE-2026-113733 — low. View-only admin users could see full password hashes for certain custom user models.

• CVE-2026-114582 — low. SpatialReference string input could trigger GDAL URL fetches or file reads; full protection requires GDAL 3.9 or later.

All six were fixed on the same day. That is the normal Django process: the advisory, the patches and the CVE records land together. A model that "confirms the bug" a day later is confirming a bug whose fix is already in the repository, and whose reproduction steps are in the public report. Reproducing a reported bug is the first job of a triage queue, so this is real work — but it is not the same as finding one.

Mistral did not name the CVE, so the claim cannot be checked against a specific advisory. If the target was outside the November batch, the post gives no way to identify it, date it, or compare the generated patch with the upstream fix. The patch itself was not published.

133 agents is an orchestration number

Agent count is a design choice, not a score. A pipeline can use 133 agents because it fans out one per file, one per hypothesis or one per attack path; the same work can be done with five agents and more turns. What changes with the count is cost, latency and the number of independent attempts — not the model's per-token capability.

The metrics that would make the count meaningful are the ones missing: how many candidate flaws were raised, how many were false positives, how many agents were needed per confirmed bug, and what the run cost in tokens. A system that raises 200 candidates to confirm one real bug is a different product from one that raises three and confirms one, and both can honestly be described as "133 agents."

Mistral's published description suggests a narrow, verifiable loop rather than open-ended discovery: reproduce in a sandbox, iterate on a patch, stop when the canary exploit fails. That loop is exactly what the Django demo shows. It is a good loop. It is also the loop a human triager runs with a debugger and a test suite.

The security numbers Mistral does publish

Mistral's open-weight post puts Mistral Large 4 at 51% on the Artificial Analysis Cyber Index, in a vendor-produced chart that places MiMo-V2.6-Pro at 56% and DeepSeek-V4.1-Flash 1017 at 57%, with Kimi K3 at 41% and GLM-5.3 at 36%. The index tests whether a model can discover vulnerabilities in a codebase, reproduce and validate them, and patch them — the same three verbs as the demo.

The same post reports a 96.6% average refusal rate on malicious cyber requests, which Mistral calls the highest it measures among open models, and 97.1% attack resistance on the B3 agent-security benchmark, up from 93.3% at preview. The October preview page also listed an 82% score on Mistral's own vulnerability reproduce-and-patch test and 93% of 40 Cybench challenges; the open-weight post does not repeat either figure.

All of these are vendor-reported. None has been independently reproduced, and the Cyber Index chart is Mistral's rendering of a third-party index rather than a leaderboard capture. That does not make the numbers wrong. It makes them claims, and the demo video is another claim in the same series.

There is a real tension in the positioning. A model tuned to refuse 96.6% of malicious cyber requests is also being sold on its ability to reproduce exploits and write patches. Mistral's answer is a specialised variant for penetration testing and red-teaming, gated behind vetting and contractual limits to owned or authorised systems. The open-weight checkpoint is the general model, with guardrails the host can tune — which is precisely why the dual-use question follows the weights rather than the API.

What would turn the demo into evidence

A credible end-to-end claim needs six things. None of them is exotic; all of them are absent from the post.

• A named CVE, or a bug with no public report — so a reader can tell discovery from reproduction.

• The vulnerable commit and the patched commit, so the diff can be reviewed.

• A before-and-after reproduction in the same environment, including the failing and passing exploit.

• The false-positive count: how many candidates the agents raised before one survived.

• Wall-clock time and token cost for the full run, not a playback multiplier.

• An independent rerun by someone who is not Mistral.

Publish those and the argument changes. Until then, the honest description is "Mistral demonstrated its triage agent on a public Django bug," which is a useful product demo and a much smaller claim than the first sentence of the post.

Running the pattern on your own codebase

The open weights are the part that matters for security teams. Mistral released the checkpoint on 29 October 2026 under the Mistral Ecosystem Open-Weight License, a modified MIT licence that permits use, modification, fine-tuning and commercialisation, but requires a separate licence for anyone operating a model-as-a-service business. The checkpoint is 1.05 trillion parameters with 49 billion active per token, a 1M-token context and an NVFP4 variant for Blackwell GPUs. Self-hosting it is a cluster purchase, not a laptop download, but it keeps source code and findings inside your perimeter — the reason a security team would choose it over an API.

The workflow is more portable than the model: map the code, generate candidate flaws, simulate the attack, reproduce in a sandbox, patch, then verify that the exploit no longer fires. The weak step in every implementation is the verifier. The same model that wrote the patch is a poor judge of it; a second model from a different family, given the diff and the reproduction, catches a meaningful share of bad patches that the first model will defend.

That is where routing helps. Mistral Large 4 is not in OrcaRouter's catalogue — it is served on Mistral's own API and downloadable for self-hosting — but OrcaRouter puts 200+ other models behind one OpenAI-compatible key with 0% markup on provider list price, automatic failover and a routing DSL that can compose a second-opinion verifier into the same call. A triage pipeline does not need one model to be good at everything; it needs the patch writer and the patch reviewer to be different, and one key is a cheaper way to get there than two vendor contracts.

The claim to watch

Mistral has the pieces of a credible security product: open weights, a documented triage loop, strong refusal metrics and a benchmark that measures the right verbs. What it does not have, in public, is a case where the model found something that was not already fixed. The next demo should name the bug, publish the diff and let someone else run it. Until then, the 133-agent video is a demonstration of orchestration, not evidence of discovery — and the word "critical" is doing more work than the Django batch supports.