Mistral shows 133 agents patching a Django CVE in a 90x demo

Mistral AI says it tested Mistral Large 4 on a recent Django CVE. In its demo, 133 agents map the code, hunt for flaws, test attack scenarios and confirm the bug. Then Le Chonk, the nickname of Large 4, patches it. We read the post, the release page and Django's security notices, and checked what the demo does and does not give a reader.

What Mistral showed

Mistral posted the demo on X on Nov 4. Its first line asks whether Large 4 can find a critical vulnerability, prove it and fix it. The one-minute video covers triage, reproduction and the patch, shown at 90x speed. At that rate, the run took roughly 90 minutes in real time, though Mistral does not say so.

The post does not name the CVE or the Django version. Django's two most recent security releases, on Oct 6 and Nov 3, fixed ten issues between them. None was rated high or critical: four were moderate, including a server-side request forgery bug in GeoJSON handling, and the rest low. The demo could be any of them, or an older one. The model behind it is new.

What Large 4 is

Mistral describes Large 4 as a flagship 1-trillion-parameter, natively multimodal model. Artificial Analysis lists it as a mixture-of-experts model with 1.1T parameters, 52B active per token and a 1M-token context, released on Oct 29. The weights are now open under the Mistral Ecosystem Open-Weight License, a modified MIT license. Companies that sell it as a hosted service need a separate commercial license.

The API costs $0.70 per million input tokens, $0.07 for cached input and $2.10 for output. The model is on Mistral's own platform, OpenRouter, Hugging Face, Nvidia's endpoints and Microsoft Foundry. Mistral's release page also describes the security workflow behind the demo.

The security pitch

The release page describes a cyber vulnerability triage demo: the model reads a report, reproduces the bug in a sandbox and patches it until a test exploit no longer works. That matches what the Django video shows. A specialized cyber variant is in preview only for Orange Cyberdefense, the French security firm.

Mistral says Large 4 scores 51% on the Artificial Analysis Cyber Index, a vendor-reported figure. In Mistral's own chart, two other models score 56% and 57%, so 51% is not the top result. It also reports 97.1% resistance to attacks on agents in the B3 benchmark, up from 93.3% for the preview, and a 96.6% refusal rate for malicious cyber requests. On the Artificial Analysis Intelligence Index, Large 4 scores 26, against a median of 23 for open-weight models. All of this describes the model, not the Django run.

What the demo cannot tell

The demo is one vendor video of one vulnerability. It shows that the workflow is possible. The post gives no hit rate across several bugs, so one success says little about how often it works.

The post also states no cost for the run and no count of false positives. A sped-up video hides how long the agents ran in real time. Artificial Analysis puts Large 4's cost per task on its index at $2.06, but without token counts for the 133 agents, the price cannot be turned into a cost per fixed bug. These are the numbers a security team would need before relying on it. Others have published more.

How others measure it

Other AI bug-hunting efforts have reported results across many targets. In DARPA's AI Cyber Challenge final in August 2025, the winning systems found 54 of 63 planted vulnerabilities and patched 43, at about $152 per task, and also found 18 real bugs. Google's Big Sleep agent found its first real-world flaw, an exploitable bug in SQLite, in October 2024.

So can Large 4 find, prove and fix a real Django bug? In this one demo, yes. But Mistral does not name the CVE, the real run time, the cost or how often the agents get it right, and the Django bugs fixed recently were mostly moderate or low, not critical. The demo shows a capable open-weight model running a full triage workflow. Until Mistral publishes results across many bugs, it is a showcase, not evidence that 133 agents beat a security team.

Sources

• Mistral AI post with the Django CVE demo, X – Nov 4
• Mistral Large 4 release page, Mistral AI – benchmarks, price, license
• Mistral Large 4 on Artificial Analysis – size, index score, cost per task
• Django security releases, Nov 3
• Django security releases, Oct 6
• DARPA AI Cyber Challenge results – background
• Google Project Zero on Big Sleep – background