Mistral got a US patent on ‘code implemented tool calls’ in 118 days. The public was never allowed to object. — Agent Wars

On 30 June 2026 the United States Patent and Trademark Office granted Mistral AI a patent titled “Code implemented tool calls”. The application was filed on 4 March 2026. That is 118 days from filing to grant, in a system where the average utility application waits somewhere north of two years.

The number is US 12,670,045 B1, application 19/557,103, twenty claims, classified at G06F 9/547. The named inventor is Gabriel Vergnaud, of Paris. The assignee is Mistral AI SAS, the company that has spent three years positioning itself as the open-weights alternative to the American labs. Of all of that, the detail worth your attention is the trailing letter.

What the claim actually says

Start with what it doesn’t say, because plenty of people have now told me that Mistral has patented the practice of letting an agent write code to call its tools. It hasn’t, and the claims are worth reading before anyone lights anything on fire.

Claim 1 is a method with a specific shape. A server receives a request. An LLM generates a code block that encapsulates the tool calls. The server runs that block in a sandbox. When execution reaches a tool call that has to happen somewhere else, the block pauses, that single pending call is transmitted to a client, the client executes it, the result comes back, execution resumes with the result substituted in for the call, and only the final output is returned to the model.

The dependent claims give away the mechanism, and it is the interesting part. Claim 4: resumption works by “using an evaluation stack that replays the code block from a beginning of the code block”. Claim 5: that stack “ensures deterministic execution by capturing and replaying results of non-deterministic operations”. Claim 10: those non-deterministic operations are wrapped in a function “configured to store initial values”.

So the sandbox does not actually suspend a live interpreter. It is stateless. It fakes a continuation by re-executing the whole block from scratch with previously recorded results substituted in, which is why the non-deterministic calls have to be captured on first execution. That is a real engineering choice with real tradeoffs, and it is narrow. Whatever else is true, the pitchfork version of this story is aimed at a target that isn’t there.

Which brings me to the part that survives the good news.

The window that never opened

Under the USPTO’s kind codes, a B1 is a utility patent granted with no pre-grant publication. B2 is the ordinary case: the application published at eighteen months, the world could read it, then it granted. B1 means the world never read it. That happens when the applicant files a nonpublication request, and it also happens when a grant simply beats the eighteen-month publication clock. At 118 days, this one would have beaten it either way. The distinction matters to Mistral’s lawyers. It makes no difference at all to everybody else, because the effect on the public is identical: the first time anyone outside the applicant and one examiner could read this document, it was already enforceable.

The America Invents Act gave the public a cheap way to interfere with a bad patent before it exists. Under 35 U.S.C. 122(e), a third party can hand the examiner prior art, with a short description of why it matters, for a nominal fee. It is the only mechanism in the system that costs a normal person less than a house. And it has a deadline: before the earlier of the notice of allowance, or the later of six months after the application publishes and the first rejection of any claim.

Read that against a B1. There was no publication, so the six-month clock never started. The only remaining boundary is the notice of allowance, and to file against a notice of allowance you must first know the application exists, which requires the publication that did not happen. The window did not close early on this one. It never opened.

Near as I can tell, that is not an exploit. It is the ordinary interaction of two rules written a decade apart, neither of which anticipated a field where the entire state of the art is eighteen months old.

The prior art that matters is in another postcode

Here is where reading the claims changes the argument rather than ending it.

The references everyone reached for do not read on claim 1. CodeAct, published by Xingyao Wang and colleagues in February 2024, established code as a unified action space for agents, but it runs in one environment: no client delegation, no pause, no resume. Cloudflare’s Code Mode converts MCP tools into a TypeScript API and executes the model’s code in a V8 isolate, reaching tools upstream from the sandbox rather than pausing to hand one back to a client. Anthropic’s code execution with MCP matches exactly one element of claim 1, the bit where the model never sees the intermediate results. Good art, wrong claim.

The art that bears on claims 4, 5 and 10 sits in durable execution, and it has been shipping in production for years in a subfield with no obvious connection to language models. Temporal resumes a workflow by replaying its code from the beginning against a recorded event history, and its Side Effect primitive exists for one purpose: run a non-deterministic snippet once, record the result, and return the recorded value on replay instead of re-executing it. Azure Durable Functions works the same way, checkpointing at each await, replaying history, and returning completed results from the record, with a documented ban on unwrapped clock and random calls for exactly the reason claim 10 wraps them.

I’m not a patent attorney and I am not calling this invalid. Validity is a question with a real record behind it, and the record includes references cited during examination that I haven’t seen. What I will say is that durable execution is the art I would want an examiner to have had in front of them, and an examiner searching G06F 9/547 for language model tool calls is not especially likely to surface a workflow engine’s documentation.

That is the whole problem in one sentence. The person most likely to know that claims 4, 5 and 10 describe workflow replay is not an examiner and not a machine. It is somebody who has spent a year fighting non-determinism errors in Temporal. The mechanism designed to get that person’s knowledge in front of the examiner is 35 U.S.C. 122(e), and for this application it was shut. The USPTO clearly knows the search problem exists on its own terms: it ran an Automated Search Pilot Program from October 2025 to April 2026, using AI to surface relevant documents before formal examination. I don’t have a clean read on how well it worked.

The strongest case against this read

Four objections, and I don’t think any of them is a strawman.

The first arrived the moment the claims did: the claim is narrow, nobody is being sued, so there is no story. On the claim, agreed, and I’ve said so above. But the story was never the claim. The machinery that let a four-month unpublished grant land in the middle of the most actively developed area in software works identically whether the claims are narrow or broad, and it is available to every applicant who wants it. A narrow first grant is the cheapest possible demonstration that the route is open.

The second is that fast is good. Pendency of two years plus is the actual scandal in the American patent system, and a 118-day grant is what happens when a well-drafted application lands with an examiner who finds it allowable on first action. Punishing speed to preserve a comment period is the tail wagging the dog. That objection is correct on its own terms, and I’d sign most of it. My disagreement is narrow: I’m not arguing against speed, I’m arguing that one of the two public checks on examination quality is wired to a publication event, so accelerating the grant silently deletes it. Fix the wiring, keep the speed.

The third is that Mistral is close to the last company you’d expect to swing this thing. It ships weights under Apache 2.0, and Apache 2.0 carries an express patent grant with a retaliation clause in section 3. Mistral also turned up in the Open Invention Network community in June 2026, eight days before this patent issued, and OIN membership means signing a patent non-aggression cross-licence. That is a real constraint, publicly made, and it deserves more credit than it usually gets.

It also has edges. The OIN covenant runs to the Linux System definition, an enumerated list of packages in Tables 0 to 13, not to software in general. Apache 2.0’s grant is narrower than people assume: it covers claims necessarily infringed by the contribution itself, and unlike the copyright grant it does not carry sublicensing rights. Neither instrument obviously reaches a competitor’s proprietary agent runtime, which is the only place a patent like this would ever be worth asserting. Good intentions are not the question. Scope is, and scope is written down.

The fourth is that the system already has a cure. If the claims are invalid over the art, file for inter partes review or ex parte reexamination and kill them. True, and here is the price list: roughly $9,000 to petition and another $14,000 if the board institutes, with all-in costs commonly quoted between $300,000 and $700,000. That is a rounding error for Google and a company-ending number for the four people maintaining an open-source agent framework. Validity is not really the variable. Who can afford to prove it is.

The wrong instrument, and the right one

The reflex when a patent like this surfaces is to shout the prior art at each other in public. That reflex is late by construction: by the time a B1 is visible, the only forum that accepts prior art cheaply has already closed, and the expensive forums do not read forums. It is also, in this case, how a week got spent arguing about CodeAct while the durable execution literature sat there untouched.

The instrument that matches the problem is boring and available. OIN maintains the Linux System definition by nomination, and it has an open call for the next table. If the agent stack, meaning the runtimes, the tool-call middleware, the MCP servers and the code-execution sandboxes, is not inside that definition, then the non-aggression covenants that the open-weights companies keep signing do not cover the layer where the fighting will happen. Nominating it is a form letter. Nobody appears to have sent one.

The bet

My read is that US 12,670,045 will never be asserted against anyone, and that this will be beside the point, because the thing worth watching was never this patent. It was the discovery that a four-month unpublished grant is available in the fastest-moving area of software, and that the public’s cheapest objection can be routed around at no cost to the applicant. That asymmetry does not require a lawsuit to matter. It only requires a second company to notice it works.

One detail sharpens the first prediction below. Something like forty paragraphs of this specification, covering figures 5 and 6, describe a generic machine learning operations platform and a generative AI operations architecture: feature stores, drift detection, RLHF pipelines, guardrails, watermarking, confidential computing. None of it is claim 1. Written description support is banked in a specification, and claims drafted later can only reach as far as the disclosure they were filed against. That much spec attached to twenty narrow claims is not a document that expects to be finished.

Three things would resolve this, and all three are checkable. First: whether continuations appear in this family over the next twelve months, and whether their claims move toward the padding. Second: whether the count of B1 grants assigned to AI labs rises through 2027 relative to B2s. If the four-month unpublished grant becomes a pattern rather than an artefact, that is the tell. Third: whether anyone nominates agent infrastructure into the OIN Linux System definition before the next table closes.

I’d take the under on the third. I would be pleased to be wrong, and it is the only one of the three that any reader of this piece can change.