Mistral Says Probe Finds No Evidence After Alleged Source-Code Leak Claim
French model lab Mistral AI publicly denied a fresh intrusion claim on September 18, 2026 after a cybercrime-forum user labelled “mrwho” advertised the sale of the company’s source code a day earlier, Numerama reported. Mistral said a thorough investigation found no evidence to support unauthorised access and confirmed its systems had not been compromised. The seller’s tree allegedly listed three hundred thirty-nine files with internal-sounding names and a sample called webstral—described as a Chrome-integrated web agent prototype—though posting samples is not proof of a live breach.
Filed under Security and dated September 21, 2026, this AI4France briefing treats the denial as French enterprise-trust news distinct from Mistral’s product partnerships. The episode echoes May claims that Mistral also disputed after a broader supply-chain incident, underscoring how European frontier labs now face rumour cycles as loudly as product launches. Enterprise buyers watching sovereign hosting deals still need clear incident language even when vendors say nothing was taken.
Why it matters: French and EU customers putting regulated data on Mistral stacks need credible breach posture. Public denials can calm markets—but only if customers get contractual notice rights and audit paths.
What it means in practice
French CISOs and procurement leads should refresh vendor incident-notification clauses; demand named security contacts for private deployments; assign an owner for continuous monitoring of model-supply claims; run time-boxed tabletop drills on leaked-weights scenarios; and prefer on-prem or SecNumCloud-adjacent paths for sensitive corpora. Read the denial beside Firefox Smart Window work and the Cloudera sovereign pairing.
Caveats come first. Absence of evidence is not forever-proof; forum samples can be fabricated; and secondary repositories may still leak. AI4France therefore presents Mistral’s September 18 statement as directional security context until independent forensic summaries appear.
What to watch next: any customer advisories; updates on private inference repos; and how Numspot France-hosted managed AI markets trust controls. Readers can continue on the AI4France homepage, or browse the Newsroom for additional briefings.
Bottom line: treat this update as orientation, not instruction. French AI security communications are now part of the product story and remain contested. Organizations that benefit most will verify claims themselves, keep humans on incident calls, and refuse to confuse a forum post—or a denial tweet—with finished assurance.