Business

Cohere buys London AI code-review start-up cubic

Cohere has acquired cubic, a London AI code-review start-up. What the deal means for UK teams using AI review tools and AppSec consolidation.

Illustration of a rising chart representing the Cohere acquisition of London AI code-review start-up cubic

Cohere has bought cubic, a young London AI code-review start-up, and its team will build a new secure coding vertical inside Cohere. For UK engineering teams already using the tool, the product stays live, but the owner has changed and the roadmap and contract terms may follow.

What happened

On 13 November 2026, Canadian AI developer Cohere confirmed that it had acquired cubic, a start-up that sells AI-driven review of pull requests and whole codebases. Neither side has disclosed a price or any other financial terms.

cubic is small and recent. Its Y Combinator profile lists it as a Spring 2025 company based in London, United Kingdom, with a team of six. CASRAI’s write-up of the deal also calls it London-based. Founder and chief executive Paul Sanglé-Ferrière announced the sale in a short post on the company blog, saying the team would move to Cohere and keep building the product. He told existing users that “cubic isn’t going anywhere”. Dealroom and Unite.AI both report that he will lead a new secure coding vertical inside Cohere.

The post says nothing about pricing, data handling or contract terms. The founders say only that the two teams could build something better together, and reach far more engineering teams.

The detail

cubic’s own site describes what Cohere has bought. The tool reviews each pull request against the whole repository and the team’s own rules, not just the lines that changed, so it can flag a change that breaks code in another service or repo. Teams can write review rules in plain English, and it also learns from the past comments of senior reviewers. It gives each change a merge-confidence score from one to five, can auto-approve changes it judges low risk, and runs nightly scans of the full codebase that create tickets and offer fixes. Coding agents such as Claude Code, Codex and Cursor can pick up its comments and fix them.

Commercially it is a per-seat SaaS product. Published pricing runs from a free starter tier to paid plans of $30, $79 and $160 per developer per month on annual billing, plus custom enterprise contracts that add SSO, SAML and audit logs. The company says it is SOC 2 compliant and that it neither stores customer code nor trains AI on it. Customers and testimonials on its site include Granola, n8n, Legora, Resend and Cal.com.

The deal makes more sense alongside Cohere’s other purchases. A few days earlier, on 10 November, Cohere closed its previously announced purchase of AISLE, a Prague vulnerability-discovery firm, which now trades as Cohere Cyber. By AISLE’s own count, its systems uncovered over 650 CVEs across the 14 months preceding the deal. Cohere now counts four completed strategic acquisitions this year. It is selling AI to governments, critical infrastructure operators and regulated enterprises that want private cloud, on-premises or fully air-gapped deployments. cubic gives that offer a developer-facing product that sits right in the pull request workflow.

Timeline showing cubic's founding in 2025, Cohere's AISLE deal in October and November 2026, and the cubic acquisition on 13 November 2026

Why it matters for UK organisations

There are two UK angles. The first is about ownership. Another London security-relevant start-up has been absorbed by an overseas buyer less than two years after it was founded. That is normal for venture-backed tooling, but early UK adopters now depend on a company with different priorities. Cohere sells to large, sovereignty-conscious buyers who run models on their own infrastructure. A seat-based GitHub app for fast-moving start-ups may or may not stay central to that plan, whatever the reassurances given on day one.

The second is about the market. Over the past year AI code review has gone from a niche to a busy category, with model providers, coding assistant vendors and established application security firms all arriving at the same pull request. For UK buyers, that means procurement decisions made in 2025 on the strength of a demo now need revisiting as the vendors change hands.

Data and assurance questions matter most here. A code-review tool sees proprietary source code, configuration and, too often, secrets that should never have been committed. Organisations under UK GDPR, the FCA’s operational resilience rules or public sector security requirements will want to know whether the processor, sub-processors, hosting regions and retention terms have changed now that a new parent owns the tool.

Expert view

I see this consolidation as good and bad news at once. When we test application estates, the most serious flaws are rarely the ones a scanner finds in a single file. They tend to be broken authorisation logic spread across services, or an innocent-looking change that undoes an assumption made elsewhere. Tools that reason across the whole repository are aimed at exactly that gap, and putting them in the hands of a well-funded model developer could speed up how good they get.

The worry is about how engineering teams behave. A confidence score and an auto-approve button are useful, but they make it easy to quietly cut the human review that catches design-level mistakes. In my experience, the riskiest moment for any security control is when people stop understanding it and start simply trusting it. AI review should cut the noise for human reviewers, not take their place, and nobody should treat it as a replacement for threat modelling or a proper penetration test of what ships.

There is also a supply chain point that boards tend to miss. Any tool that has read access to your repositories and can open pull requests is a privileged identity in your build pipeline. A change of ownership is exactly when integration permissions, OAuth grants and webhook endpoints should be reviewed again, not just carried over.

What to do now

  1. Find out where it is used. Check GitHub organisation app installations and procurement records for cubic and any other AI review tools. Developers often add free tiers without security sign-off.
  2. Re-read the paperwork. Ask for updated data processing terms, a current sub-processor list and confirmation of hosting regions and retention. Check your contract for change-of-control clauses and notice obligations.
  3. Review permissions. Cut the app’s repository scope to what it needs, remove unused installs and confirm who can change its settings. This maps directly to the user access control and secure configuration requirements in Cyber Essentials.
  4. Keep humans in the loop. Require human approval for changes touching authentication, authorisation, cryptography and payment flows, whatever confidence score the tool gives. Turn off auto-approval for those paths.
  5. Measure it. Track what the tool finds, what it misses and how often it is wrong, and compare that against your static analysis and pentest findings before relying on it more.
  6. Plan an exit. Know how you would switch tools if the product changes direction. Keep review rules and policies in your own repositories, not only in a vendor’s dashboard.

Bottom line

Cohere’s purchase of cubic is a small deal by headcount but tells you where the market is going: AI code review is being folded into the platforms of large model developers. UK teams using these tools should treat the change of owner as a trigger for a proper supplier review, tighten the permissions they have granted, and make sure automated approval never quietly replaces engineers who understand the code.

Sources

Related Posts