Ethical Stack.

Devstral Small 2

24B Apache 2.0 coding model for codebase exploration, multi-file edits and software-agent tool use, with 256k context and image input.

Score calculation

(3 + 1 + 7 + 2 + 3) ÷ 5 = 3.2

5 of six dimensions rated. Unrated dimensions are excluded from the average.

Full scoring method ↗
Setup details

Devstral Small 2 24B Instruct 2512 weights; Mistral Labs API identifier labs-devstral-small-2512 is a separate experimental hosted route.

What fits your needs

Devstral Small 2 24B Instruct 2512 weights; Mistral Labs API identifier labs-devstral-small-2512 is a separate experimental hosted route.

Code work

Card describes using tools to explore codebases and edit multiple files for software-engineering agents.

See the evidence

Run locally

The 24B card says local deployment is supported on a single RTX 4090 or a Mac with 32GB RAM.

See the evidence

Vision input

Devstral Small 2 adds image analysis alongside text input.

See the evidence
Tradeoffs to expect

Labs stability

Mistral lists Devstral Small 2 as a Labs model that may change or be removed with one month notice and is not recommended for production.

See the evidence

Agent behavior depends on harness

The checkpoint supplies tool calls, while file access, command execution and approval settings come from the client.

See the evidence
How to switch

Run behind local server

Serve the model with vLLM or another OpenAI-compatible backend, configure Vibe’s local provider, and disable telemetry/update checks for an offline CLI route.

See the evidence
Practical questions

Local execution

The Vibe CLI can point to a local server and run without contacting Mistral when telemetry and update checks are disabled; external connectors remain separate.

See the evidence

Sensitive actions

Vibe Code requests approval for sensitive actions, but applies file edits without asking by default unless an ask agent is configured.

See the evidence

Hosted Labs lifecycle

If using the Labs endpoint, expect experimental availability and check its current lifecycle status.

See the evidence

Energy practices

3/10↑

This grades disclosed operating practices, not the electricity or emissions of a particular generation.

See the evidence

The release gives limited runtime or control details but no comparable per-task footprint or electricity-source evidence. The model card lists a 24B checkpoint and local hardware examples, defining a disclosed inference boundary. Mistral recommends setting a shorter max model length and supports lower-precision local inference; the guide does not quantify energy saved.

1 + 1 reporting + 0 electricity + 1 controls = 3/10. This grades documented practices and transparency.

Per-task energy, serving region, facility electricity mix, water and independent footprint review are not established in the cited release sources.

Reporting1/3
The model card lists a 24B checkpoint and local hardware examples, defining a disclosed inference boundary.
Electricity sourcing0/3
The release materials do not report matched regional electricity sourcing or carbon-free supply for training or inference.
Resource controls1/3
Mistral recommends setting a shorter max model length and supports lower-precision local inference; the guide does not quantify energy saved.

Water disclosure

Water reporting has not been assessed for this choice.

Training data

1/10↑

The model release does not provide a complete inspectable training-source permission record.

See the evidence

The reviewed release documentation the release card documents the code-focused model and license but no training data sources or permission basis. It provides no source-level permission ledger or creator remedy; a model-weight license governs downstream use, not the material used to train the model.

1 base + 0 source transparency + 0 documented permission + 0 creator controls = 1/10.

Named source inventory, source-level licenses, creator remedies, and independent verification remain unestablished for this release.

Source transparency0/3
The release card documents the code-focused model and license but no training data sources or permission basis.
Documented permission0/4
The release sources do not publish a training-source permission basis or rights ledger; the weight license doesn’t settle training-data permission.
Creator controls0/2
No training-source creator permission-before-use, opt-out, removal or retraining route is documented for this release.
Data-rights rubric ↗

Your data & privacy

—Not enough evidence↑

Privacy has no single score for these downloadable weights because handling depends on the inference host and integrations.

See the evidence

The release can be run locally, but it also appears in hosted provider routes; those operators set their own request retention, training and region terms. A cloud API, where offered, is a separate policy route and is not inherited from the local weights.

A selected host, network path, telemetry, logging, external prompt enhancement, and data retention need route-specific review.

Openness

7/10↑

Apache 2.0 weights and local inference examples are public; the full training data and recipe are not.

See the evidence

The model card includes weights, Apache 2.0 terms and implementation examples for local model serving, but not enough to reproduce the training run. This rating concerns release artifacts and reproducibility, not training-data permission.

7/10 reflects open weights and reproducible inference, with no full training recipe or source inventory.

Training data sources, full training recipe and dataset rights are not disclosed for Devstral Small 2.

Worker protections

2/10↑

Mistral publicly says its supplier code applies to goods and services and its Trust Center shows contractors acknowledge a code, but labor-specific provisions and outcomes were not publicly inspectable.

See the evidence

Mistral’s August 2026 help page states that its Code of Conduct sets standards suppliers are expected to follow for Mistral business and all supplier goods/services; the Trust Center lists contractor acknowledgment of the Code of Conduct. The public interface did not expose the code’s labor clauses or worker procedures, and no worker survey, audit, pay/conditions disclosure or remediation results were located. This supports limited credit for a supplier-code commitment only. These findings concern the developer or operator. This product’s use in a particular deployment needs separate evidence.

1 + 1 pay & conditions + 0 worker voice & remedy + 0 evidence & follow-through = 2/10. This grades documented worker safeguards, not a measured rate of mistreatment.

The supplier code’s detailed labor language and coverage of AI data workers, grievance route, monitoring and outcomes were not accessible from the public Trust Center.

Pay & conditions1/3
A supplier code is a stated business requirement, but its labor content and implementation were not publicly inspectable in this review.
Worker voice & remedy0/3
No public worker-specific voice or grievance mechanism was established in the accessible sources.
Evidence & follow-through0/3
The Trust Center shows contractor code acknowledgment but no labor-specific audits, remediation or outcomes.
Workers rubric ↗

Military ties

3/10Broad defense ties↑

Mistral AI publicly partners with defense AI company Helsing on joint development of vision-language-action models, and its current company page says it serves defense customers. A separate Airbus agreement includes military aerospace applications; specific Mistral model deployments in weapons systems are not established.

See the evidence

Mistral's announcement with Helsing describes joint development of next-generation AI systems for European defense, while Helsing's announcement links its military AI portfolio to Ukraine-deployed strike drones and fighter electronic-warfare capabilities. Mistral also identifies defense as a customer sector and Airbus says the partnership includes military aerospace applications. This is broad defense enablement, capped at 3/10; no binding weapons/surveillance prohibitions or military-use oversight outcomes are public in these sources. These findings concern the developer or operator. This product’s use in a particular deployment needs separate evidence.

1 + 0 use restrictions + 0 enforcement & oversight + 2 relationship disclosure = 3/10. Known defense ties lower this rating; safeguards can improve it within the relationship’s cap.

The sources don’t confirm which Mistral models, if any, are deployed in specific military systems, the operational purpose or safeguards, contract restrictions, or independent oversight. Helsing's existing strike systems are not evidence that Mistral models themselves control or target weapons.

Use restrictions0/4
The reviewed public partnership and company materials do not disclose binding restrictions on weapons, harmful surveillance, or military-intelligence use.
Enforcement & oversight0/3
No public military-specific review, enforcement mechanism, or independent outcome assessment was identified in the reviewed partnership materials.
Relationship disclosure2/2
Mistral and its partners identify the defense relationships and intended applications, including VLA model development and military aerospace, though no model-level deployment details or outcomes are disclosed.

Mistral publicly confirms joint defense-AI development and military-aerospace partnerships, but no source establishes its model in actual targeting or combat intelligence use. The relationship limits this grade to 3/10.

Military rubric ↗

BDS targets

Not listed↑

We did not find Mistral AI among the named targets in the two official BNC campaign lists. This is a limited list check, not BDS approval.

See the evidence

Mistral AI is not a named target in the checked lists, but BDS uses selective campaigns, so absence cannot establish a clean record. Running downloaded weights locally is a different decision from paying the developer or a cloud host; check the host as well. These findings concern the developer or operator. This product’s use in a particular deployment needs separate evidence.

This review covers the named targets in the BNC consumer/pressure guide and No Tech campaign, not every BDS campaign, local group, investment or supplier. Lists and ownership can change. A company’s absence from these lists is not an endorsement or proof that it has no relevant relationships.

More from Mistral AI

All sources

Side by side