Cohere has signed a letter of intent to acquire AISLE, the AI cybersecurity startup whose software has found more than 500 real vulnerabilities in its first year. Announced on October 15, 2026, the deal folds AISLE’s AI-powered vulnerability discovery into the business Cohere is assembling through its merger with Germany’s Aleph Alpha, a combination reported to be worth about $20 billion. Here is what the deal covers, who AISLE is, and why this acquisition signals a bigger shift in how the software industry will hunt for security flaws.
The bottom line: Cohere is buying one of the few AI security teams whose findings open source maintainers actually trust. AISLE’s 500-plus validated CVEs, including three quarters of cURL’s latest release, make this less a talent acquisition and more a land grab for proven defensive AI at a moment when every frontier lab is racing into cybersecurity.
What was announced
Cohere, the Canadian AI lab focused on enterprise customers, said on Thursday that it has signed a letter of intent to buy AISLE, a San Francisco-based startup that uses AI to detect vulnerabilities in software. The financial terms were not disclosed.
According to Cohere, the acquisition is aimed at strengthening security and threat detection for enterprise and public sector clients, with the combined offering available for private deployment on a customer’s own systems. The deal also extends Cohere’s European footprint through AISLE’s engineering hub in Prague. In a statement, Cohere said that increasingly capable AI systems are transforming both cybersecurity and the threats organizations face, and that defensive capabilities must advance just as quickly.
The move fits a pattern of AI labs buying their way into cybersecurity. Only days earlier, Anthropic detailed its Cyber Mission program offering free AI security scans for open source projects, and Google’s PageBreak agent has been credited with finding hundreds of confirmed web vulnerabilities. AI-powered vulnerability discovery has moved from research novelty to strategic infrastructure in a matter of months.
Who is AISLE
AISLE was founded in 2025 by Ondrej Vlcek, the former CEO of Czech antivirus maker Avast, together with co-founders from Google DeepMind and Anthropic. The company describes itself as a pioneer in AI-native vulnerability lifecycle management: its platform is designed to take security teams from detection through validated, human-approved fixes in a closed loop that runs across cloud, on-premises, and air-gapped environments.
In its first year out of stealth, AISLE’s track record has been unusually public for a startup:
- More than 500 assigned CVEs across over 100 codebases, all discovered in real-world software and independently validated by project maintainers.
- OpenSSL: 20 of the 23 vulnerabilities disclosed across three security releases, including all 12 in OpenSSL’s January 2026 release, with 10 AISLE-generated fixes accepted into official releases.
- cURL: 35 CVEs and 160 additional security and performance bugs, including an authentication vulnerability that had sat in the code for 25 years.
- FreeBSD: three CVEs in the same release cycle as Anthropic’s own findings, including a remote code execution flaw undetected for roughly 20 years.
- FFmpeg: 13 CVEs across two rounds of research, one of them a stack overflow that had survived 19 years.
- Publicly documented findings in NASA CryptoLib, Cursor, Visual Studio Code, Wireshark, MySQL, MariaDB, PostgreSQL, and OpenEMR.
The company also became a CVE Numbering Authority and Researcher CNA under the ENISA Root, and the European Union agency selected AISLE to continuously review the code behind the vulnerability reporting platform for Europe’s Cyber Resilience Act.
The cURL story is the real signal
The most telling detail is what happened with cURL. Earlier in 2026, cURL founder Daniel Stenberg discontinued the project’s bug bounty program and in July temporarily suspended vulnerability reporting altogether, worn down by a flood of low-quality AI-generated vulnerability reports. AI-assisted bug hunting was producing noise, not signal.
AISLE’s platform changed his mind. After months of consistently accurate findings, Stenberg asked the company to perform a dedicated security review of cURL’s codebase in late August 2026. The results: 18 of the 24 CVEs addressed in cURL’s October 14 release came from AISLE, three quarters of the total. cURL is estimated to run in 30 billion installations, so these are fixes that touch nearly every connected device on the planet.
Stenberg said the cooperation was unlike anything he had seen with a security organization, crediting detailed and accurate findings backed by skilled humans with letting the project identify and fix vulnerabilities faster than ever.
This is the quality problem the whole industry is wrestling with. Google recently froze its open source bug bounty program, citing a surge of automated, mostly invalid AI submissions. AISLE’s approach, which it calls system over model, combines specialized research, model selection, codebase context, parallel analysis, validation, and remediation into one integrated pipeline, with human review in the loop. Its CTO, Dr. Stanislav Fort, argues that frontier-scale models alone do not win at this task: after some of the world’s most advanced AI systems had already examined cURL, AISLE’s smaller specialized system kept finding real vulnerabilities that maintainers reproduced and fixed.
That framing is important for Cohere, which does not operate the largest models. The deal is a bet that the complete system, from discovery to maintainer-validated fix, matters more than raw model size.
Why Cohere wants this
Three strategic reasons stand out:
1. Enterprise and public sector differentiation
Cohere’s business is selling AI to large organizations, especially regulated industries and governments that run on private infrastructure. Embedding AISLE’s vulnerability discovery into that offering gives customers continuous, autonomous security analysis of the software they actually run, with fixes that can be validated before deployment.
2. The European play
The acquisition deepens Cohere’s European presence alongside the Aleph Alpha merger. AISLE’s Prague engineering hub and its existing work with ENISA on the Cyber Resilience Act give the combined company genuine credibility with European regulators and public sector buyers, a market where trust and data sovereignty are decisive.
3. The AI security arms race
Attackers are using AI to find and exploit flaws faster than ever, from AI-discovered zero-days to automated exploit generation. OpenAI’s work with Block on autonomous defense agents, Anthropic’s free open source scans, and now Cohere’s acquisition all point to the same conclusion: AI labs see cybersecurity as core infrastructure, not a side business.
What happens next
A letter of intent is not a closed deal. The parties will still need to finalize terms, and acquisitions of this profile can attract regulatory attention in the United States, Canada, and Europe. The companies have not announced a timeline or an expected closing date.
If the deal completes, expect AISLE’s technology to be woven into Cohere’s enterprise platform, likely with emphasis on private deployments for regulated customers. Watch also for how the combined company handles AISLE’s research organization, whose independent disclosures across open source projects have been central to its credibility. The maintainers who trust AISLE because it works in the open may scrutinize a corporate-owned successor more carefully.
The broader signal is harder to miss. Independent rankings from the UC Berkeley Vulnerability Initiative’s Agentic Vulnerability Coverage Map already place AISLE first or tied for first on measures of real-world AI-attributed vulnerability discovery, ahead of far larger labs on this specific task. Consolidation around the few teams that can produce maintainer-validated results, rather than AI-generated noise, is now underway.
Frequently asked questions
Is the Cohere AISLE acquisition finalized?
No. Cohere announced a signed letter of intent on October 15, 2026, not a completed acquisition. Terms were not disclosed, and no closing date has been announced.
What does AISLE do?
AISLE builds an AI-powered vulnerability lifecycle management platform that discovers, triages, validates, and helps remediate software vulnerabilities autonomously, with human approval on fixes. It has had more than 500 CVEs assigned in its first year across 100-plus codebases.
Who founded AISLE?
AISLE was founded in 2025 by Ondrej Vlcek, former CEO of Avast, with co-founders from Google DeepMind and Anthropic.
Why is the cURL finding significant?
cURL runs in an estimated 30 billion installations. AISLE’s AI accounted for 18 of the 24 CVEs in cURL’s October 14, 2026 release, including a 25-year-old authentication flaw. The project’s maintainer had shut down the bug bounty program earlier this year because of low-quality AI-generated reports, making AISLE’s validated results the exception that rebuilt trust.
How does the deal connect to the Aleph Alpha merger?
Cohere said the acquisition adds cybersecurity to the business it is assembling through its merger with Germany’s Aleph Alpha, a combination reported to be worth about $20 billion, and extends its European footprint through AISLE’s Prague engineering hub.
What does this mean for enterprise security teams?
If the deal closes, expect AISLE’s autonomous vulnerability discovery and remediation to appear inside Cohere’s enterprise offering, deployable privately on customer infrastructure. The bigger trend is that AI labs now treat defensive cybersecurity as strategic: automated discovery, validation, and patch generation are becoming standard enterprise AI features.