Cohere buys AISLE / The AI lab is buying the bug hunter
SAN FRANCISCO, October 15, 2026 — Canadian artificial intelligence company Cohere has signed a letter of intent to acquire AISLE, a San Francisco cybersecurity startup that uses AI to detect vulnerabilities in software, Reuters reported on Thursday. The financial terms were not disclosed. A letter of intent is a statement of agreed purpose rather than a completed transaction — deals at this stage can still be reshaped or abandoned in diligence — but the direction of travel is clear, and it fits the company Cohere has been assembling: an AI supplier aimed squarely at enterprises and governments that want powerful models deployed privately, on their own systems, under their own control.
A one-year-old startup with an outsized scoreboard
AISLE was founded in 2025 by Ondrej Vlcek, the former chief executive of Avast, the Czech antivirus company that grew from its Prague roots into one of the world's largest consumer security firms, together with co-founders drawn from Google DeepMind and Anthropic — two of the laboratories at the centre of the AI race itself. That pedigree helps explain the startup's first-year record. AISLE says its AI systems found more than 500 previously unknown bugs in widely used software during its first twelve months. The figure that commands attention inside the security industry is narrower: twelve of those vulnerabilities were in OpenSSL, the open-source encryption library that quietly secures an enormous share of the world's sensitive traffic — used by banks, governments and messaging applications alike. The OpenSSL flaws were fixed after AISLE reported them, which is the outcome the whole arrangement is designed to produce: the bug is found by a defender, disclosed responsibly, and patched before an attacker finds it first.
Why an AI lab wants a security company
Cohere's stated reasoning, in paraphrase, is that increasingly capable AI is transforming both sides of cybersecurity at once — the threats and the defence — and that defensive capability therefore has to advance just as quickly as the offensive kind. That is not a marketing line so much as a description of the current moment. AI coding assistants now write a large and growing share of the world's new software, at speeds no human review process was built to audit. AI systems are also increasingly capable of probing software for weaknesses autonomously. If the volume of code and the speed of attack are both compounding, then defence that depends entirely on human auditors with checklists falls behind by construction. A tool that can read code the way the machines write it — tirelessly, at scale, hunting for the specific patterns that become exploits — is the obvious counterweight, and it is what AISLE claims to have built.
The deal also extends Cohere's map. AISLE's engineering hub is in Prague, a city with a deep security-engineering tradition — Avast itself was founded there — and the acquisition deepens the European footprint of the business Cohere is assembling through its merger with Germany's Aleph Alpha. That combination, reported to be worth about $20 billion, is aimed at enterprise and public-sector clients, with private deployment on customers' own systems as a central selling point. For a bank or a ministry, the pitch practically writes itself: the same vendor that supplies the models also supplies the team and the tooling that hunts for vulnerabilities in the software those models touch. Security stops being an add-on and becomes part of the platform.
Why this matters
The deeper significance is where the boundary of an "AI company" is moving. The first phase of the industry sold models. The second is selling everything around the models that a serious institution needs before it can trust them: deployment inside its own walls, in its own jurisdictions, and — with this deal — defence of the software estate the models operate in. There is also a quiet arms-race logic that regulators and security researchers have been warning about all year: vulnerability discovery is dual-use. The same capability that patches OpenSSL can, in other hands, catalogue the weaknesses of the systems the rest of us depend on. When a frontier-adjacent lab buys a bug-hunting team outright, it is betting that owning defensive capability is both a commercial differentiator and a form of insurance — and it is an implicit admission that the labs themselves now see AI-driven offence as a when, not an if.
The other side: what the sceptics will watch
Balanced against that logic are real cautions. First, this is a letter of intent with undisclosed terms: until the acquisition closes, Cohere has announced an intention, not an asset, and small acquisitions of young startups fail to close or fail to integrate often enough that the distinction matters. Second, AISLE's headline numbers are the company's own account of its first year; the security community will want to know how many of the 500 findings were severe, how many were duplicates or minor issues, and how the false-positive rate compares with human-led audits and rival automated tools — volume alone is not the same as value. Third, consolidation itself cuts both ways: vulnerability research concentrated inside the largest AI vendors could speed up patching, or it could narrow the independent scrutiny that open security research depends on — the OpenSSL fixes, after all, protected everyone, including Cohere's competitors. Supporters of the deal answer that defence has been chronically underfunded relative to offence, that AISLE's responsible-disclosure record is the right model, and that putting its team inside a well-capitalised lab gives the work resources a standalone startup could not match. Both readings are honest; the evidence will arrive in the form of disclosed bugs, patched libraries and renewed contracts, or it will not arrive at all.
What happens next
The immediate steps are procedural: diligence, final terms, and a closing that converts the letter of intent into ownership, on a timetable neither side has published. After that, the questions become practical. Does AISLE's tooling get folded into Cohere's enterprise and public-sector offerings as a named security product, or does it operate as a specialist unit serving outside customers as well? Do the Prague and San Francisco teams keep publishing and disclosing findings at the pace that made the startup worth buying? And do rival labs answer with security acquisitions of their own — the surest sign that this deal marks a category rather than a curiosity? The numbers that will settle the argument are not the undisclosed price. They are the next twelve OpenSSL-class findings, and whether they are announced by defenders first.
Sources: Reuters, "Cohere to buy cybersecurity startup AISLE," October 15, 2026. Related on Signal Post News: FTC probe of OpenAI and Anthropic over rogue AI agents; OpenAI Daybreak and Ukraine's cyber defence; Anthropic's warning on self-replicating AI worms and IoT risk.