Cohere plans to buy AISLE, the AI bug hunter behind 500 CVEs

Cohere plans to buy AISLE, the AI bug hunter behind 500 CVEs

15 October 2026: Cohere, the Canadian maker of enterprise language models, has signed a letter of intent to acquire AISLE, a start-up whose AI systems find, validate and help fix previously unknown vulnerabilities in production software. Cohere says AISLE found more than 500 vulnerabilities that were assigned CVEs across more than 100 codebases in its first year, and that the deal would bring security research into its own model development.

Not yet independently verified. This is a letter of intent, not a signed purchase agreement, and neither company states a price or an expected closing date. We found no statement from AISLE itself. We will update this when it can be confirmed, and remove this note.

Cohere announced the proposal on 15 October. Reuters reported the same day that AISLE is based in San Francisco with an engineering hub in Prague, and was founded in 2025 by Ondrej Vlcek, the former chief executive of the Czech antivirus maker Avast.

What AISLE has found so far

Cohere credits AISLE with all 12 vulnerabilities in OpenSSL's January security release and 18 of the 24 CVEs in curl's latest release, which we covered on 14 October. Cohere stresses that these are real zero-day flaws reviewed by the maintainers of each project, not benchmark results.

AISLE's method, as Cohere describes it, pairs foundation models with security specialists, large-scale code analysis, validation of each finding and automated remediation. Cohere says the reverse also matters: hard, verifiable security problems can be used to evaluate and improve future models.

Where it fits in Cohere's European build-out

Cohere presents the deal as part of its investment in Europe, following its acquisitions of Reliant AI and of Aleph Alpha, the German model developer. Cohere sells what it calls sovereign AI, models and agents that customers can run in a private cloud, on their own premises or in fully air-gapped environments, aimed at governments, critical infrastructure and highly regulated industries.

Cohere lists what it expects the combined business to deliver: security and threat detection for enterprise and public sector deployments, governance and monitoring for AI agents and autonomous workflows, and better protection for sensitive data and critical systems, all in the same private deployment options.

What is still open

The letter of intent is not a completed sale. Cohere gives no price, no timetable and no word on whether AISLE's research will stay available to the open-source projects it has been reporting flaws to, or on what happens to AISLE's existing customers. Reuters notes that the combination with Aleph Alpha has been reported to be worth about $20 billion, a figure neither company has confirmed in what we read.

We list several Cohere models, including Command R+ and Embed v3, and our vulnerability management software category lists 16 products.

Sources

• Cohere: Cohere and AISLE sign letter of intent to advance cyber-resilient sovereign AI (read 15 October 2026), 15 October 2026
• Reuters via Euronext: Cohere moves to buy AI cybersecurity startup AISLE, 15 October 2026