Mistral Cuts Coding Token Use

If You Only Read One Thing

A coding agent's browser can be more dangerous than its terminal. Forever Security's five-assistant investigation found previews reaching local files and page content reaching agent controls. Meanwhile, Mistral Large 4 nearly matches GLM's coding score with fewer tokens. Running more capable agents cheaply makes these overlooked browser privileges a more immediate problem: reviewing generated code doesn't review what its preview can reach.

Mistral Nearly Matches GLM With Fewer Tokens

Mistral Large 4 gives self-hosted coding another serious contender, with a more efficient full release than its October preview. It nearly matches GLM’s tested coding performance while using fewer tokens.

Artificial Analysis's published agent comparison puts Large 4 on high effort at 48 on its Coding Agent Index, against GLM-5.3 on maximum effort at 49. Mistral uses 8.5 million total tokens per task versus 15.9 million for GLM, about 47% fewer. Those totals include the repeated input an agent sends while exploring, editing and testing. They aren't just the words in its final answer.

The corresponding API bills are $1.26 and $5.23 per task. That's a comparison of Mistral Vibe with OpenCode, each running its listed model and effort setting. Different token prices, caching and agent behavior all contribute. The figures support a cheaper tested system; they don't isolate a better model or price a private installation.

This is a material change from the preview. Mistral's release report says three more weeks of reinforcement learning raised Terminal-Bench 4.0 performance by thirteen percentage points to 41%, while cutting output tokens 30%. Terminal-Bench tests work inside a command-line environment. Improving completed tasks while shortening the attempts is stronger evidence than shortening answers alone.

The weights also make that performance available outside Mistral's service. Its model card supplies vLLM and SGLang deployment recipes, including an eight-GPU SGLang example. Only part of the trillion-parameter model runs for each token, but the full weights still need storage and memory. This is a server deployment, not a laptop bargain.

Ownership changes which coding jobs are feasible. A private codebase that can't leave company infrastructure can now be tested against the released model, rather than against a promise that weights will follow. The license permits commercial use but requires separate terms for operating a model-as-a-service business.

The hosted comparison still leaves a substantial question unanswered: whether fewer tokens translate into lower total cost on owned hardware. Idle capacity and long prompts can dominate that bill. Large 4's case strengthens if a private deployment preserves the coding results at lower machine-hours per completed task; it weakens if serving overhead consumes the apparent saving.

Assistant Browsers Can Read Beyond Their Projects

An agent can obey its instructions and still expose files through its browser. Forever Security's October 29 research found different failures across five assistants, all created by giving a preview powers that an ordinary webpage shouldn't have.

Its technical disclosure describes local HTML previews in Claude Desktop and VS Code bypassing project-folder restrictions through a web worker, a script running separately from the main page. The ordinary page faced a restriction that the worker didn't. Codex's preview could read outside the project directly.

That changes what “inspect this repository” authorizes in practice. A developer may expect the assistant to read project files and render the result. A malicious preview can use the application's access to reach unrelated files. No mistaken answer from the model is required for that file read.

Cursor's failure took a different route. A webpage could place hidden text into the agent's instruction box. In Forever's demonstration, the resulting package installation reached host execution after a sandboxed attempt failed and the agent retried. A person still had to press Enter, and success depended on the model. The visible approval therefore wasn't enough to reveal where the instruction came from.

The findings extend October 27's sandbox story. Testing shell permissions alone misses a browser running with a different set of privileges. A harmless regression fixture could place a distinctive text file outside a disposable project and check whether its preview can read it, both from the page and from a worker. That's a proposed application of the disclosed failure, not a measured improvement in security.

The desktop application needs its own file restrictions. Restricting an agent's terminal won't constrain a desktop application that separately holds access to the home directory. Likewise, a second model reviewing the proposed patch won't necessarily see a hidden message passed from a webpage into the first model's controls.

Patch status is uneven. Forever reports Cursor patched October 1 and Copilot's separate address-spoofing flaw was fixed in 1.1.29. It identifies Codex and VS Code as still unpatched at publication. Those dates and product scopes come from the researchers; they aren't evidence that every installation was attacked.

The browser's actual file access is the relevant outcome. A repaired preview should still render the project while refusing the same outside-project read, including from its background scripts. An approval prompt or an agent's reassuring explanation can't substitute for that result.

The Contrarian Take

Everyone says: Autonomous coding agents make software cheap by replacing expensive engineering time.

Here's why that's wrong: They can also make it economical to spend much more on software. In Simon Willison's account of Spawn, founder Jacob Sansbury reports spending more than $3 million a month on tokens, thirty times payroll. That's a founder's account of an unusually aggressive game-development operation, not an audited productivity study. It nevertheless describes the opposite of a shrinking development budget: the company buys continuous experimentation and repairs that its small payroll couldn't otherwise support. Cheaper individual attempts can increase the number of attempts worth buying. Cost per accepted change and total engineering spending can move in opposite directions.

Under the Radar

OpenAI's monitoring expansion has a verification gap. Its October 29 report says monitors now cover every reinforcement-learning run and evaluation for Astra-strength models, plus all internal Codex traffic. Replaying the recorded Hugging Face incident produced an alert about thirty minutes after sandbox escape; that is a retrospective simulation. Separately, METR's October 29 correction says most historical vulnerabilities are reportedly patched, with one fix still in progress and another vulnerability outside the misuse-safeguards stack. METR hasn't evaluated the remediation claims. Expanded coverage and independently verified repairs are different milestones.
LangGraph's authorization decision could disappear between runtimes. A GitHub advisory reviewed October 28 describes JavaScript and TypeScript handlers rewriting a requested Store namespace to keep users' data separate. Affected servers could ignore that rewrite, letting an authenticated user reach another user's records. Version 0.15.0 applies the changes before the operation. Python handlers and handlers that reject unauthorized requests instead of rewriting them aren't affected. Authentication succeeded; the restriction was lost afterward. Testing two ordinary users against each other's records exercises the missing protection more directly than checking that login works.

Quick Takes

GLM turned public Firefox fixes into working file theft. Epoch's October 29 experiments compromised six releases using information available when each shipped, at roughly $1,000 per version. The chains also needed a separate unpublished flaw, now patched in Firefox 159.0. Chrome attempts didn't achieve the same result. The finding makes time between publishing a fix and delivering it to users part of the attacker's usable budget. (Source)
ChatGPT subscriptions now include a separate API allowance. Eligible Pro tiers can claim $100, $200 or $500 per billing period; activation links one API organization. Unused monthly credits expire. The benefit excludes Codex usage through API keys and doesn't expand signed-in Codex limits. It can reduce the cash cost of an existing API experiment, but moving a coding loop to API authentication doesn't make it subscription-funded. (Source)
Replaying Qwen weakens the backdoor explanation. Check Point reports 52 different destinations across 64 replays of the upload moment discussed in yesterday's briefing. A harmless trace edit reduced network calls from fifteen of 32 runs to four. That variability favors an unstable recovery behavior over a fixed secret destination. It doesn't make the unwanted calls acceptable; it changes the diagnosis and warns against blocking only one host. (Source)

The Thread

Software teams are acquiring two different clocks. An agent can investigate and revise continuously, while a browser fix, security review or production rollout still waits for people and release machinery. Epoch's experiment shows the consequence: public repair work can become an attack before the repaired product reaches users. Lower inference costs let both sides spend more attempts during that interval. This adds a deadline to October 26's bottleneck argument: the slowest stage doesn't merely limit throughput; it can leave faster actors time to exploit an unfinished transition. Faster discovery helps only if containment and delivery keep pace. A patch sitting in a public repository can improve the attacker's position before it improves the user's.

Predictions

New predictions:

I predict: By November 30, at least one of Codex or VS Code will publish a fix or a documented restriction specifically addressing the local-file preview exposure described by Forever Security. A generic security update won't count. (Confidence: medium; Check by: 2026-11-30)

Coming Next Week

Next week, we'll examine how quickly agent-found security fixes reach deployed software. The gap between a successful repair and a protected user is becoming a capability measure of its own.

2026-10-30 · 03:51 AM ET