Security analysts at Mistral AI found no evidence of a system intrusion following allegations that the firm's private intellectual property had been leaked. The company issued a statement on September 18 confirming that its production environment remained secure despite a public attempt to sell internal files by a threat actor known as mrwho.

The seller advertised a 339 file tree pointing to private inference, finetune, and client repositories on a darknet forum. Mistral confirmed a May 2026 supply chain attack on a third party code management path that tainted SDK packages, which the current actor linked to the September listing through unrotated development secrets.