Business

Cohere moves to buy AI bug hunter AISLE and launch Cohere Cyber

Cohere signs letter of intent to buy AI vulnerability hunter AISLE and form Cohere Cyber. What it means for UK security buyers and patching teams.

Graphic headline reading Cohere moves to buy AI bug hunter AISLE, with an acquisition label

Cohere has signed a letter of intent to buy AISLE, a young company whose AI hunts for unknown flaws in production software, and will fold it into a new Cohere Cyber unit. The deal shows frontier model makers moving into the vulnerability discovery market, and UK buyers of application security tools should take note.

What happened

On Thursday 15 October 2026, Canadian AI lab Cohere announced it had signed a letter of intent to acquire AISLE, a cyber security start-up founded in 2025. AISLE builds autonomous systems that find software vulnerabilities, check that they are real and help produce fixes. Neither side has disclosed financial terms, closing conditions or a timetable. A letter of intent is not a signed purchase agreement, so the deal could still change.

If it completes, AISLE’s leadership will take senior roles at Cohere. Chief executive Ondrej Vlcek, who used to run Czech antivirus firm Avast, becomes senior vice-president of a new division called Cohere Cyber. Co-founder Jaya Baloo, a well-known security leader who was previously chief security officer at Rapid7, becomes Cohere’s global chief information security officer. Co-founder and CTO Stanislav Fort, who previously worked at Anthropic and Google DeepMind, will become vice-president of AI security. BetaKit reports that AISLE has about 50 full-time staff, all of whom will move to Cohere.

Reports differ on where AISLE is based. Reuters calls it a San Francisco start-up, while BetaKit and AISLE’s own announcement describe Prague as its headquarters and engineering hub. According to The Logic, the company has offices in both cities, and the Prague site will become a Cohere office once the deal closes.

The detail

The deal is the latest in a run of Cohere acquisitions with a European angle this year. In May it bought Reliant AI, which has a presence in Montreal and Berlin and builds software that helps drugmakers review research papers and regulatory paperwork. In September it agreed to combine with German AI developer Aleph Alpha, a combination Reuters says has been reported to be worth about $20 billion. Cohere sells itself as an option for governments and regulated businesses that are wary of the large US platforms and of Chinese model developers. A large part of that pitch is that its models can run in private cloud, on customers’ own servers or in fully air-gapped environments.

Cohere’s statement said security is “one of the most important factors determining successful adoption” of AI in business. It also argued that defensive capabilities must keep pace as AI systems become more capable. Co-founder Ivan Zhang wrote on X, as reported by BetaKit, that there are “meaningful gaps” in the tools defenders currently have. The Logic adds another reason. Chief executive Aidan Gomez has acknowledged Cohere’s models trail those of OpenAI and Anthropic, especially at coding and security work. Buying a team that points AI at real codebases to find real bugs is a quick way to close that gap, and gives Cohere verifiable problems to train future models on.

AISLE’s results so far are its own claims, but they are substantial. The company says it has found more than 500 previously unknown vulnerabilities that went on to receive CVE identifiers, spread across more than 100 codebases. It also says it found all 12 flaws in OpenSSL’s January security release and 18 of the 24 CVEs in curl’s most recent release.

Timeline of Cohere's 2026 deals, from Reliant AI and Aleph Alpha to the planned AISLE acquisition and Cohere Cyber launch

Why it matters for UK organisations

Cohere has unusually close links to the UK for a company headquartered in Canada. Its chief executive is based in Britain, and in June it nearly tripled its London footprint with a new office on New Oxford Street that can hold up to 100 staff. Since June 2025 it has also had a memorandum of understanding with the Department for Science, Innovation and Technology. The voluntary memorandum covers AI in public services, AI security research with the AI Security Institute and possible defence use. A Cohere Cyber division would give the company a security product to bring to those discussions, alongside its models.

The wider picture matters more. Big AI developers are now buying vulnerability research as a capability, not just funding it. For UK organisations this cuts both ways. Open-source components that nearly every British business depends on, such as OpenSSL and curl, are getting more scrutiny than they have ever had, and that is good for everyone. But the volume of disclosed flaws is growing fast. October’s record Patch Tuesday has already shown how stretched patching teams are, and AI-driven discovery will only add to that load.

Procurement is also affected. UK buyers in regulated sectors, and suppliers likely to be caught by the Cyber Security and Resilience Bill, will increasingly be offered security tools sold together with a particular model vendor’s platform. That can work well, but it adds another dependency to assess.

Expert view

In my experience, automated bug hunting has always looked better in a press release than in a client’s backlog. Static analysers have produced mountains of noise for twenty years. If AISLE’s claim holds up, what is different now is validation: the systems confirm a flaw is real before a human sees it, and they propose a fix. Maintainers have recently complained loudly about AI-generated junk reports, so a vendor whose findings are accepted, assigned CVEs and fixed has evidence worth more than any benchmark.

I am more cautious about the consolidation. When a security capability sits inside a model vendor, that vendor has commercial reasons to steer customers towards its own platform. Buyers should ask whether Cohere Cyber’s tools will work with other models and in their existing pipelines, or only inside Cohere’s ecosystem. Air-gapped deployment helps defence customers, but on premises does not automatically mean safe.

The same technology works for attackers as well as defenders. When we test client estates, the time between a disclosure and a working exploit is already short. AI that finds bugs at scale will narrow the gap between discovery and attack for everyone, so the strongest protection is still the dull basics done consistently.

What to do now

  1. Know your dependencies. Keep an up-to-date software bill of materials so that when a library like OpenSSL or curl publishes a batch of fixes, you can find every affected system within hours. This supports the Cyber Essentials security update management control.
  2. Tighten patch timelines. Cyber Essentials requires high and critical fixes within 14 days. Plan for more frequent, larger releases and test a faster route for internet-facing systems.
  3. Ask vendors hard questions. If you are evaluating AI-based code scanning, ask about false positive rates, how many findings were accepted by maintainers, where your code is processed, and whether the tool depends on a single model provider.
  4. Review supplier concentration. Add AI and security platform providers to your third-party risk register, recording contract terms, data location and exit options.

Bottom line

Cohere’s move for AISLE is still only a letter of intent, but it points in a clear direction: frontier AI developers want to own vulnerability discovery, not merely support it. Treat the extra disclosures as a test of your patching discipline, and judge these tools on their verified results rather than their headlines.

Sources

Related Posts