Lucien

finding critical zerodays with the new model, LE CHONK (informal name: mistral 4 large), an open weights eu model by mistral. this tweet is probably for you if you're want to jailbreak your own appliances, or do infosec/blue teaming work. i've been sitting on a document for a long time of software i'd consider critical to the internet (something all of you use, even if you don't know it) that could use another look. yesterday, as i mentioned, i had chonk explore parts of a messaging app that is widely used, and it found a zero-click medium/high zero-day in under 30 minutes, and *less than 10 dollars in api spend*. these vulnerabilities are now reported (can't reveal until patched). when i've used it, i've had very few outright refusals. the intent behind chonky is to good at cyber, in a defensive context. however, in order to do that, you also need to be good at cyber in an offensive context. but for those looking to customize their TVs that would otherwise be locked down, this thing will tear them apart for you, and it will gladly look at prior arts (several exploits for nearly all TVs that expose a surface is out there), same with pretty much any other device that lives on your network. the things it will refuse to do is outright write exploit chains, however with how succinct the reports this thing writes are, writing a poc to confirm a vulnerability is completely doable. so far i'm very impressed. it seems pretty frontier when it comes to cyber and reasoning (practically no one has anthropic cyber access and daybreak is only gpt-5.6), it can also be as bad as any other model if you don't put effort into your prompts. it is addicted to tool calls, and very brief on prose. but the reasoning is incredible to watch, if you point it in the right direction, and you have a background in infosec. the way it operates is something i've never seen before (thousands of tool calls, ingest of data, analysis, before any prose, depending on codebase complexity), it feels eerily like an human auditor would behave lol. some config tips: it will definitely work in a codex harness, but i'd recommend trying the vibe cli harness with le chonk. the more tools it has access to (if they're right for the job), the better of a job it'll do in my experience. the amount it loves tool calls really cannot be understated. if an inference provider through a router is trying to serve you another model, it will be instantly evident that it's not le chonk, just by how it operates. it's hard to convey, but it's not like any other LLM i've ever tried. people in the subscriber groupchat have also reported finding their first vulnerabilities with le chonk so it seems i'm not just an anomaly. le chonk scores extremely high on reasoning, but i've yet to try to use it for anything except infosec work, i don't know if it's a great day-to-day model, but i'll have it go head to head with GLM-5.3 at some point in a general swe workflow. i did a few tweets on it yesterday out of sheer euphoria, not sponsored, mistral has given me credits now to continue work. this hopefully ties me over until i can get my hands on enough sparks to run it locally. go give this model a try, let me know how it works for you. with the daybreak program now collecting data (why...?), and this being OPEN WEIGHTS the only thing i can think to end this on is: we're so fucking back.