Mistral releases Mistral Large 4's open weights, with the API at $0.70/$2.10 per million tokens
Mistral publishes the weights for Mistral Large 4 ("Le Chonk") and lists its API at $0.70/$2.10 per million tokens, half of GLM-5.3's. Radware finds a campaign that hit 61 public repos through GitHub Actions workflows in under an hour, Deepgram buys Daily and puts Pipecat in a foundation, and Cohere closes the first part of a Series E of up to C$7 billion.
- Mistral released the weights for Mistral Large 4, a 1.05-trillion-parameter MoE with 52 billion active and a 1M context, and its API now lists at $0.70 input and $2.10 output per million tokens, down from $1.36/$4.18 earlier this week.
- On Mistral’s numbers it ties GLM-5.3 on Artificial Analysis’ Coding Agent Index at half GLM-5.3’s API price, but the licence requires a separate deal for anyone selling it as a hosted service.
- Radware found a campaign, likely one person, that hid shell commands in issues and comments on 61 public repos, including Trivy, MLflow and github/docs, and ran them through vulnerable GitHub Actions workflows.
- Deepgram is buying Daily, the WebRTC company behind Pipecat, and Pipecat moves to an independent foundation whose steering committee includes Deepgram’s rivals.
- Cohere announced the first close of a Series E targeting up to C$7 billion, led by Schwarz Group with the Government of Canada and NVIDIA participating.
- DoorDash agreed to buy Instacart for about $17 billion, at least 75% in cash, closing by the first half of 2028.
Le Chonk’s weights land
Mistral published the weights for Mistral Large 4, nicknamed “Le Chonk”, on Hugging Face on 29 October, three weeks after the API preview. The model docs list 1.05 trillion parameters, 52 billion active, a 1M-token context and image input. The API now costs $0.70 per million input tokens, $0.07 cached and $2.10 output, down from $1.36/$4.18 when we checked early on 29 October and level with its earlier launch discount; Mistral’s post doesn’t say whether the new price is permanent. The model is still labelled public preview. It is also on OpenRouter, NVIDIA NIM and Microsoft Foundry. The licence is the Mistral Ecosystem Open-Weight License, a modified MIT: commercial use and fine-tuning are allowed, but selling it as a hosted model needs a separate licence from Mistral.
Why it matters
Teams that want a frontier-class model on their own hardware now have a European option with a usable licence, as long as they aren’t an inference host. Mistral’s serving examples use 8-GPU nodes, and an NVFP4 checkpoint targets Blackwell.
Cheaper than GLM-5.3, with strings attached
Mistral says Le Chonk scores 48% on Artificial Analysis’ Coding Agent Index, “effectively tied” with GLM-5.3, while using 47% fewer tokens per task; those are Mistral’s citations, not yet independently checked. On each lab’s own API (models table), GLM-5.3 costs $1.40/$4.40 and is text-only, so Le Chonk is half the price with image input. DeepSeek’s smaller V4.1 Flash is still cheaper at $0.30/$1.20 peak. Expect the hosting clause to keep Le Chonk off some third-party inference menus.
61 repos hit through GitHub Actions in under an hour
Radware researchers found a campaign that posted at least 83 malicious issues, pull requests and comments to 61 public GitHub repositories, The Register reports. 77 went up in a 43-minute window on 1 September and six more within two minutes, from 74 accounts, many apparently compromised. Radware suspects a single person. Commands hidden in HTML comments reached workflows that pasted the text into shell scripts, which tried to send environment variables to the attacker. Targets included Trivy, MLflow, CopilotKit, Homebrew Cask and github/docs. Logs show the commands ran in two cases; Radware couldn’t confirm write access or tampered code. Most projects have fixed or closed the workflows.
Why it matters
Anyone can open an issue, so any workflow that runs on issues, comments or pull requests and interpolates their text into run: is exposed. Pass untrusted text through environment variables, and keep secrets out of those jobs.
Workflow injection is now scripted
This is an old bug class run at scale, not a new GitHub flaw. Expect more of it as AI projects add bots that react to every issue.
Deepgram buys Pipecat’s maker
Deepgram is acquiring Daily, the WebRTC infrastructure company that created Pipecat, the open-source framework many teams use to wire speech-to-text, an LLM and text-to-speech into a voice agent. Terms weren’t disclosed. Pipecat moves to an independent foundation with a steering committee drawn from across the real-time AI industry, Deepgram’s competitors included. Daily says nothing changes for its customers, and Deepgram will sell, support and develop Daily’s WebRTC and telephony products.
Why it matters
If your voice agent runs on Pipecat with another vendor’s speech models, the foundation is the promise that it stays vendor-neutral. Watch who joins the committee.
Deepgram is buying the plumbing, not a model
Deepgram sells its own all-in-one Voice Agent API, an alternative to assembling a Pipecat stack (our voice AI comparison). Owning Daily likely gives it the transport layer and the developer relationships around what Daily calls the most widely used voice agent framework. The foundation looks like the price of keeping those developers.
Cohere’s sovereign-AI raise
Cohere announced the initial close of a Series E targeting up to C$7 billion, led by Schwarz Group. Bell Ventures, Bullhound, Inovia, NVIDIA, Prosperity7 and the Government of Canada are in; Cohere gave no valuation or per-investor amounts. It says it will complete its combination with Aleph Alpha and its acquisition of AISLE, and build frontier models and cyber defences outside the US and China.
Why it matters
Regulated buyers in Canada and Europe get a better-funded option that runs in their own cloud or air-gapped datacentre.
Cohere is selling control, not benchmarks
Cohere pitches the round on sovereignty: models built outside the US and China, running where the customer chooses. With 2025 revenue reported at about $240 million, Cohere is betting that state money and Schwarz’s datacentres buy it time to reach the frontier.
Quick hits
- DoorDash agrees to buy Instacart for about $17 billion: $65 a share, at least 75% cash, closing at the end of 2027 or first half of 2028 pending US, Canadian and Israeli approval.
- Supabase opens a Multigres private alpha: three-node Postgres clusters with automatic failover “within seconds” and built-in pooling, free for up to two projects on paid plans, US East only and not for production yet.
- OpenAI’s updated Model Spec sets out five values: faithfulness to human intent, minimising harm, honesty, human agency and care; developer messages still outrank users, and tool output has no authority.
- LangChain Managed Deep Agents v0.10: browser use with a human sign-in handoff and async subagents, in public beta;
connectors.mcp()is removed, a breaking change. - Cloudflare’s Q3 DDoS report: attacks over 1 Tbps fell nearly 69% to 251, which Cloudflare says may reflect police action against IoT botnets; short, small attacks rose 208%.