How should a team run Mistral Vibe from first install to a merged change? Buy the plan and settle data handling first, start in accept-edits or a stricter mode with admin config pushed to every machine, and review each change like a pull request. The steps follow Mistral's Vibe Code documentation and the problems users have reported in public.
When you need this
- Engineers are trying Vibe on personal Free or Pro accounts and want a team setup.
- Someone asks whether Vibe may run with auto-approve.
- Security asks where prompts and code go, and whether they train Mistral's models.
- A heavy user ran out of included usage before the end of the month.
Evaluation criteria
Before work: buy the plan and the key
Which account pays for each engineer's sessions?
Look forPro at US$14.99 per month or Team at US$24.99 per user per month, before tax. Included usage is one monthly budget shared across Vibe Code, Studio, and the API. One user reports that Mistral support told them a regular API key in Vibe bills at full API rates while a Vibe key draws on the plan's discounted rate. Issue keys deliberately.
Before work: set data controls
What leaves the machine, and does it train a model?
Look forTraining opt-out for the organization (Enterprise is opted out by default), enable_telemetry set to false, and a zero data retention request if your policy needs it. The EU regional endpoint is documented for the API only, and a user who asked how to point Vibe at it found no setting for it.
During work: start in accept-edits or stricter
What may Vibe do without asking?
Look forThe default accept-edits mode, or ask for unfamiliar repositories, with enable_auto_approve set to false in admin config. Setting a bash allowlist replaces the entire default list; it does not append entries. Also, one user who read the source found file patterns match the resolved absolute path, so test a permission profile before relying on it.
During work: contain untrusted repositories
Can a cloned repository make Vibe run code?
Look forContainers or VMs for code you did not write. Researchers showed a shell permission bypass in 2.25.0, fixed in 2.25.4, and a user reported code execution through .gitattributes filters when Vibe creates a worktree.
During work: watch usage
Will the agent stop halfway through the month?
Look forUsage checks in the admin panel and a decision on pay-as-you-go before anyone hits the limit. Heavy users report using up a Pro plan within days, and one notes that plans cannot be stacked on one account.
Before merge: review every change
Does a Vibe change meet the bar a colleague's would?
Look forNormal code review and passing tests before merge. Users report that Vibe adds its own signature line to Git commits, so decide whether that line stays in your history.
Questions to ask vendors
- Can Vibe CLI and Vibe Code Web traffic be pinned to EU processing, and on which plans?
- How much included usage does each plan carry per model, and where can a team see it per user?
- Which settings in admin config can a user override locally, and which can they not?
- Where should researchers report a security issue in Vibe, and how fast are fixes released?
Red flags
- Engineers run auto-approve or --yolo on machines that hold production credentials.
- Nobody has opted the organization out of training on a Free, Pro, or Team plan.
- Pay-as-you-go is on with no budget owner.
- Vibe works outside a container in repositories nobody on the team has vetted.
Products in this piece
Sources
- Official documentation
- 10
- Public source
- 9
- Mistral pricing
- Mistral docs: API keys and profiles
- Mistral docs: Safety, approvals, and permissions
- Mistral docs: Agents
- Mistral docs: Admin config
- Mistral docs: Configuration
- Mistral help: Do you use my user data to train your models?
- Mistral help: Can I opt out of my input or output data being used for training?
- Mistral docs: Zero data retention
- Mistral docs: Regional inference
- Reddit r/MistralAI: how the Pro budget, Vibe key, and API key bill (Sep 18, 2026)
- Hacker News, phillc73: two Vibe subscriptions used up in six days (Oct 6, 2026)
- GitHub issue #275: usage rate limits unclear for a paying user (Jan 26, 2026)
- Reddit r/MistralAI: four things I got wrong about Vibe CLI's permission config (Sep 22, 2026)
- SecMate blog: Mistral Vibe shell permission bypass leading to arbitrary code execution (Sep 23, 2026)
- GitHub issue #997: code execution through .gitattributes filters on worktree creation (Aug 12, 2026)
- Reddit r/MistralAI: Vibe adds its signature to Git commits (Jul 4, 2026)
- Reddit r/MistralAI: telemetry and commit signature on by default (Sep 16, 2026)
- Reddit r/MistralAI: keeping Vibe CLI traffic on the EU endpoint (Sep 18, 2026)