Cohere Signs Deal to Acquire AISLE, the AI Startup That Found 500+ Software Flaws in Its First Year

On October 15, the Canadian AI company Cohere announced it had signed a letter of intent to acquire AISLE, a cybersecurity startup that uses artificial intelligence to find and fix software vulnerabilities. AISLE has existed for roughly a year, yet its systems have already surfaced more than 500 previously unknown bugs in widely used software. The move tells you where the enterprise AI race is quietly heading: the winners may be the labs that can credibly promise their systems are safe to run.

The deal, in brief

Cohere said Thursday it had signed a letter of intent to buy AISLE, a San Francisco-based startup. A letter of intent is a preliminary agreement, not a finished acquisition, and financial terms were not disclosed.

According to the announcement, the deal would add cybersecurity muscle to Cohere's enterprise offering: security and threat-detection tools aimed at businesses and government agencies. It would also deepen Cohere's European footprint through AISLE's engineering hub in Prague, a city with deep roots in antivirus software. Cohere framed it as part of its continued investment in Europe, and the combined offering would reportedly include private deployment, letting customers run the tools on their own systems instead of sending sensitive data elsewhere.

A startup with an unusual resume

AISLE was founded in 2025, which makes its track record worth a second look. Its founder is Ondrej Vlcek, the former chief executive of Avast, the Czech antivirus maker. His co-founders came from Google DeepMind and Anthropic.

In its first year, the company says its AI identified more than 500 previously unknown software vulnerabilities. The detail that matters is where some of those bugs lived: 12 were in OpenSSL, the free encryption software protecting internet traffic for banks, governments, and messaging apps. Those flaws were fixed after discovery. A single undiscovered flaw in a library like OpenSSL can put millions of systems at risk at once, so an AI that can find a dozen of them in a year is exactly the kind of capability enterprises and governments would pay for.

Why Cohere wants a security division

Cohere, based in Toronto, builds AI products for businesses rather than consumers. Enterprise buyers care about accuracy, but they care just as much about control: where data lives, who can see it, and whether new software introduces new risks.

The acquisition would bolt a security practice onto the business Cohere is assembling through its merger with Aleph Alpha, the German AI company. That combination has been reported to be worth about $20 billion. In August, Cohere reportedly raised $500 million in a round including AMD Ventures, Nvidia, and the venture arm of Salesforce, valuing the company at $6.8 billion.

Cohere's statement put the logic plainly: "Increasingly capable AI systems are transforming both cybersecurity and the threats organizations face, and defensive capabilities must advance just as quickly." The same technology that makes AI useful makes attacks cheaper, so defense has to keep pace.

There is a sovereignty angle too. In September, Bell Cyber deployed a Cohere-powered cybersecurity model inside its Toronto security operations center, running on Bell's AI Fabric infrastructure so sensitive security data stays in a Canadian-hosted environment. Adding AISLE's vulnerability-hunting technology would give that sovereign-AI pitch sharper teeth.

The threat landscape makes the timing hard to miss

The announcement landed in the same week as an unsettling reminder of why this matters. According to reports from threat intelligence researcher Snorre Fagerland of the security firm NorForge, autonomous AI agents were used to breach the websites of more than 100 companies in a campaign that began in late September.

Fagerland found the activity while scanning for exposed deployments of Cairn, an open-source multi-agent AI framework. The attackers reportedly delegated nearly all of the work to AI agents, with successful intrusions taking about 23 hours and costing an estimated $50 in AI tokens each. Reuters independently examined the activity and identified victims including Deere, SharkNinja, and Cummins, with e-commerce sites targeted across the United States, Canada, Australia, and Japan. The scale of data taken remains unclear. But the pattern is the point: AI is no longer just a tool security teams use. It is also the tool attackers reach for first.

What is still unknown

Plenty. A letter of intent is a statement of intent, nothing more, and neither company has shared a closing timeline. The price is undisclosed, and it is unclear whether AISLE would operate independently or be folded into Cohere's existing teams.

Other questions have no answers yet. Will AISLE's vulnerability research stay independent enough that the security community keeps trusting its disclosures? How fast can its technology be turned into products for Cohere's enterprise and public-sector customers? And will regulators take an interest in a deal that concentrates AI security capability inside one of the West's largest AI companies?

What is knowable is the direction of travel. Canada helped pioneer modern AI, and its government is spending heavily to make sure Canadian companies can commercialize it. Cohere buying one of the most productive young security teams in the business fits that ambition. The letter of intent is a beginning, not an ending, but it is one worth watching.

Frequently Asked Questions

What exactly did Cohere announce?

Cohere announced on October 15 that it had signed a letter of intent to acquire AISLE, a cybersecurity startup that uses AI to detect software vulnerabilities. It is a preliminary agreement rather than a completed purchase, and financial terms were not disclosed. The stated goal is to strengthen Cohere's security and threat-detection offerings for enterprise and government customers while expanding its European presence through AISLE's Prague engineering hub.

Why is AI-driven vulnerability discovery such a big deal?

Modern software depends on shared building blocks like OpenSSL, so one hidden flaw can affect banks, governments, and messaging apps all at once. AISLE says its AI found more than 500 previously unknown vulnerabilities in its first year, including 12 in OpenSSL. Automated hunting tools are in demand because human teams cannot manually review the millions of lines of code modern systems contain.

Could the deal fall through?

Yes. A letter of intent signals serious interest but is not a binding purchase agreement. Deals at this stage can still collapse over price, due diligence findings, or regulatory concerns. Neither company has announced a closing timeline, so the acquisition is planned, not finished.