Cohere and AISLE announced on October 15, 2026 that they have signed a letter of intent (LoI) for Cohere to acquire AISLE, an AI cybersecurity company that builds autonomous systems for finding and fixing vulnerabilities in widely used software. Reuters reported that the terms were not disclosed. If completed, AISLE's founders would lead a new unit called Cohere Cyber. This article covers what each side has said, what the curl numbers actually show, how the move fits Cohere's strategy, and what is still unknown.
What was announced
AISLE's own announcement, signed by co-founders Ondrej Vlcek, Jaya Baloo and Stanislav Fort, says that when the transaction completes, its Prague headquarters will become Cohere's Prague office. Vlcek, the CEO, would become Senior Vice President of Cohere Cyber, described as a new unit that brings cybersecurity solutions to Cohere's customers. Baloo would become Cohere's global Chief Information Security Officer. Fort, the CTO and Chief Scientist, would become Vice President, AI Security, leading AI security research and working with Cohere co-founder and CTO Ivan Zhang to connect it to model development and training.
Reuters, as syndicated by local news outlets, described AISLE as a San Francisco cybersecurity startup, while AISLE says its headquarters is in Prague. Reuters also reported that the deal would add cybersecurity to the group Cohere is forming through its merger with Germany's Aleph Alpha, reportedly worth about $20 billion, and extend Cohere's European presence. Our earlier piece covers that merger: Cohere and Aleph Alpha's $20B sovereign AI merger.
One wording difference is worth flagging. Reuters and AISLE both describe a letter of intent, which is typically a statement of intent to negotiate and not a final agreement. Techzine's report says Cohere "has entered into an agreement to acquire" AISLE without using the term. We treat the LoI as the operative status, and AISLE itself says it will share more details as the transaction progresses.
What AISLE says it has found
AISLE says it left stealth almost exactly a year ago and has since discovered more than 500 previously unknown vulnerabilities that were assigned CVEs, across more than 100 codebases. Its examples are all 12 vulnerabilities in OpenSSL's January security release and 18 of the 24 CVEs in curl's latest release. These are the company's own figures; Techzine notes that maintainers independently review the findings, and the individual CVEs are public.
AISLE says the system determines how models explore large codebases, reject false positives, and turn findings into patches that maintainers trust.
AISLE announcement, October 15, 2026
Simple arithmetic frames the scale: 500 CVEs across 100 codebases is at most about 5 per codebase on average, though a few large projects such as OpenSSL and curl likely account for a disproportionate share, and the distribution has not been published. The two examples are also the strongest ones; the headline numbers should not be read as a typical hit rate.
Checking the curl numbers
We checked the claim against curl's own vulnerability list. Twenty-four advisories carry the publication date October 14, 2026, which matches AISLE's denominator of 24. By our count from that list, the same project published 18 CVEs on June 24 and 9 on September 2, 8 on April 29, 4 on March 11 and 6 on January 7. That makes October's batch the largest of 2026 by this count, and about 35 percent of the 69 CVEs published so far this year (24 divided by 69).
curl: CVEs published per security release, 2026
Number of advisories on curl's vulnerability list sharing each publication date.
Counts tallied by Metir from the entries on curl's published CVE list (curl.se/docs/security.html) as read on October 15, 2026. The list marks 23 of the 24 October entries Low severity and one High.
Two caveats apply. First, the list does not credit finders in the same view we could read, so the 18 of 24 attribution rests on AISLE's statement and the Techzine and Reuters reports repeating it; we did not verify it advisory by advisory. Second, severity matters: the list marks 23 of the 24 October entries as Low and one as High (an HTTP/2 upload use-after-free), so volume is not the same as danger. Many entries concern connection reuse, credential leaks on redirects and cookie handling, the kind of logic flaw that a model reading code at scale can surface.
The maintainer burden
The curl project illustrates the other side of AI-driven discovery. A July 2026 Pinggy report says curl stopped taking bug reports through its HackerOne program until August 3. We have not confirmed that against curl's own announcements, so treat it as reported context, not settled fact.
What the curl table does show is the downstream workload: each CVE needs triage, a fix, a coordinated disclosure and an advisory, and 24 advisories in one release is a larger batch than any earlier release this year. AISLE's pitch is that validated findings with patches maintainers trust reduce that load compared with unverified reports. Whether the net effect is a lighter or heavier burden depends on report quality, which maintainers, not vendors, are best placed to judge.
Why a model company buys a vulnerability finder
Cohere and AISLE give three reasons that can be read from their statements:
- Security research feeding training. AISLE says Cohere is the right place to bring security research directly into model development, and Techzine reports Cohere plans to use verifiable security problems to evaluate future models. A found-and-patched CVE is an unusually checkable task, which makes it useful as an evaluation signal.
- Enterprise and sovereign positioning. Cohere says it wants security as a core part of its sovereign AI platform, including secure deployment in air-gapped environments. Reuters reports private deployment on customers' own systems as a goal.
- Talent and a named security leader. The deal brings a CISO and an AI security research lead into a company building a large European footprint.
Other labs are moving the same direction without acquisitions: see our coverage of Anthropic's cyber verification program, OpenAI's GPT-6 cyber model preview and Armadin's $255M raise. The difference is that Cohere is buying a specialist team, a pattern we also track in AI-on-AI acquisitions.
What remains unknown
- Price and structure. No terms were disclosed, and neither source mentions AISLE's funding, valuation or investors.
- Closing. An LoI is not binding in the way a definitive agreement is, and no closing date or regulatory path was given.
- Product continuity. AISLE says its focus for customers and partners is continuity and stronger products, with details to come.
- Independent verification of attribution. The CVE counts are company claims, and per-advisory credit has not been audited here.
- Interaction with the Aleph Alpha merger. Reuters links the deal to that group, but how the pieces combine operationally has not been described.
The takeaway
The Cohere-AISLE LoI is a model company paying for proof that its technology can find real defects in critical code, and for a security brand to sell to regulated and sovereign customers. The curl data adds a useful check: October's batch of 24 CVEs is the largest of the year, while 23 of them are Low severity, so AI-driven discovery is raising volume faster than it is raising headline risk. How much of that discovery translates into lasting safety, and how maintainers absorb it, will matter more than the deal terms, which nobody has yet published.
Sources:
- AISLE and Cohere to Join Forces | AISLE blog
- Cohere moves to buy AI cybersecurity startup AISLE (Reuters syndication) | 93.3 The Drive
- Cohere Moves to Buy AI Cybersecurity Startup AISLE | Global Banking and Finance
- Cohere plans to acquire AI security startup AISLE | Techzine Global
- curl CVEs, published vulnerabilities | curl.se
- Curl's Summer of Bliss: Why It Stopped Taking Bug Reports in July 2026 | Pinggy
Image credits
Header image: skyline of Prague with Vltava bridges, by MurderousPass, via Wikimedia Commons, released under CC0. In-body photograph: Prague silhouettes at dawn, by PetarM, via Wikimedia Commons, licensed CC BY-SA 4.0. Both are illustrative of the city where AISLE is headquartered; neither shows AISLE or Cohere.