Cohere signs deal to buy AI bug hunter AISLE and launch Cohere Cyber

What Cohere and AISLE announced

Cohere, the Toronto-based company that builds AI models for businesses and governments, plans to buy AISLE, a young company whose AI systems find and help fix unknown security holes in widely used software. Both companies announced on 15 October that they had signed a letter of intent. In its announcement, Cohere said the deal would create a new business unit called Cohere Cyber to sell cybersecurity products to its customers.

A letter of intent is a step toward a deal, not a finished one. Neither company disclosed a price, and AISLE's own post says the companies will share more details “as the transaction progresses.” When it completes, AISLE's Prague headquarters will become Cohere's Prague office, and Cohere says it plans a substantial long-term investment there to make the city its global centre for AI cybersecurity and autonomous security systems.

AISLE has about 50 full-time employees, all of whom will join Cohere, an AISLE spokesperson told BetaKit. Cohere gave Reuters the same headcount. Reuters, in a report carried by Investing.com, described AISLE as San Francisco-based with an engineering hub in Prague, while AISLE itself refers to its Prague headquarters. Cohere's blog says AISLE was founded in 2024; Reuters says 2025. The company came out of stealth in October 2025, a year before the deal.

Who AISLE is and what it built

AISLE builds what it calls an autonomous system for software security: AI that searches large codebases for vulnerabilities, tries to disprove its own findings, reproduces the ones that survive, and drafts a patch. In its joint post with Cohere, AISLE's three founders, Ondrej Vlcek, Jaya Baloo and Stanislav Fort, said the biggest lesson of the past year was that “model capabilities and the surrounding system reinforce each other.” The system decides how a model explores code, rejects false positives and turns findings into patches that maintainers trust; better models raise the ceiling of that system.

The founders come from established security and AI backgrounds. Vlcek was chief executive of the Czech antivirus maker Avast. Baloo was AISLE's chief operating officer and a co-founder, and Fort, AISLE's chief technology officer and chief scientist, previously worked at Anthropic and Google DeepMind, according to BetaKit and The Globe and Mail.

On 14 October, a day before the deal, AISLE published a product update promising proof of exploitability for its findings, memory-safety proofs, a server for the Model Context Protocol so AI agents can call its tools, and a firewall for AI-suggested software packages. Those features are announced, not independently tested.

The curl and OpenSSL record behind the deal

Cohere's case for the deal rests on AISLE's public record. According to both companies, AISLE has found more than 500 previously unknown vulnerabilities that were assigned CVE identifiers, the public IDs used to track security flaws, across more than 100 codebases in its first year. That includes all 12 vulnerabilities in OpenSSL's January 2026 security release. In a year-in-review post, Fort wrote that across three OpenSSL releases between September 2025 and April 2026, OpenSSL disclosed 23 zero-days, of which AISLE found 20 and wrote accepted fixes for 10.

The most recent result came on 14 October, when the curl project released version 8.23.0 with fixes for 24 previously unknown vulnerabilities. AISLE says it found 18 of them. Its technical write-up lists them: several cases where passwords, certificates or authentication headers survived a redirect or a reused connection and reached the wrong server, four bugs in how curl saves cookies and HSTS security settings, protocol edge cases including an IMAP command injection, and two crash or hang bugs. AISLE counts 35 curl CVEs and 160 other bug fixes from a year of work on the project.

curl's founder and lead developer, Daniel Stenberg, confirmed the scale of that work on his blog. In a post titled A curl audit by Aisle, he called it curl's fifth official external audit and wrote that AISLE “has found more CVEs in curl than any other group or individual ever did before.” He added that the cooperation was “like with no other security organization before” because the detailed findings were “backed up by a team of skilled humans.”

AISLE also frames its record as a comparison with the big labs. It says curl looked at AISLE's tools after Stenberg reported in August that Anthropic's Mythos and OpenAI's Codex Security had found no additional curl bugs, and that a Mythos scan in May produced one low-severity CVE out of five claimed issues. Those comparisons are AISLE's own account. AISLE also says a UC Berkeley tracker of AI-attributed CVEs ranks it first or tied for first in five of eight measures, with Anthropic leading on the count of critical vulnerabilities. AI Lookout has covered similar results from XBOW's Chrome exploit chain and Anthropic's OSS Scanner, so the field is crowded.

Who gets which job

All three AISLE founders get senior roles at Cohere. Vlcek will become senior vice president of Cohere Cyber and run the new cybersecurity business. Baloo will become Cohere's global chief information security officer, responsible for security across the whole company rather than only the new unit. Fort will become vice president of AI security and join Cohere's core model research and training work, where he will lead AI security research with Cohere co-founder and chief technology officer Ivan Zhang.

That last appointment is the most technical part of the deal. Cohere says it wants to explore “how difficult, verifiable security problems can help evaluate and improve future models.” A vulnerability report either reproduces or it does not, and maintainers decide whether it earns a CVE, which makes it a cleaner test of a model than many benchmarks. Cohere CEO Aidan Gomez wrote on LinkedIn, as quoted by The Globe and Mail, that AISLE had defended open-source software “better than many of the more well known efforts.”

Vlcek wrote on LinkedIn that the two companies began talking earlier this year and saw the combination as a natural fit. He also framed it as a European and Canadian answer to US AI giants: “We can either keep complaining about it, or do something about it.”

Why Cohere wants a security unit

Cohere sells models and its North agent platform to banks, governments and other regulated customers that often need to run AI in their own data centres or in fully offline environments. AI Lookout covered North 2, its reusable-agent update, earlier this month. Cohere says AISLE's technology should help it add threat detection for those deployments, monitoring and governance for AI agents, and protection for sensitive data, all of which can run in private cloud, on-premises or air-gapped settings.

Ivan Zhang argued in an X post, quoted by BetaKit, that defenders face a hard trade-off between securing their systems and exposing their code and telemetry to a provider that offers zero data retention only “performatively.” In an interview with The Globe and Mail, he said defenders have an edge because “it's actually easier to patch vulnerabilities than it is to discover them and chain them together to attack a target.”

The deal also continues Cohere's buying spree in Europe. It bought Reliant AI, which has operations in Montreal and Berlin, in May, and announced a combination with Germany's Aleph Alpha, maker of the Kolibri open-weight model, that still needs regulatory approval. Reuters reported that combination to be worth about $20 billion, and The Globe and Mail has reported that Cohere is in talks to raise upward of $3 billion. Security is a growing worry for those customers: The Globe noted recent cases of AI agents leaving test sandboxes and reaching real systems.

What the deal does not settle yet

This section is AI Lookout analysis. The deal is not closed, the price is unknown, and neither company has said what regulatory approvals it needs or when it expects to complete. Cohere has not said whether AISLE's product will keep its name, whether existing customers' contracts change, or how AISLE's open-source work with projects such as curl and OpenSSL will continue inside a larger company. AISLE says only that its focus for customers and partners is “continuity and stronger products.”

AISLE's numbers deserve the usual care. The 500 CVEs and the curl counts are the company's own tallies, although the curl figures are backed by Stenberg's post and the project's release notes. CVE counts also measure volume more than severity, a limit AISLE itself acknowledges. The comparisons with Mythos and Codex Security come from one project and from AISLE's description of events, not from a controlled head-to-head test.

What to watch: a signed purchase agreement and closing date, any disclosed price, the first Cohere Cyber product, and whether Cohere publishes evidence that security tasks actually improve its Command models. AI Lookout will update this article when the transaction completes or new details are published.