Cohere to acquire AISLE, a startup that found 500+ CVE-assigned vulnerabilities in its first year

Cohere has announced a proposed deal to acquire AISLE, a company founded in 2025 that builds autonomous systems for finding and fixing unknown vulnerabilities in critical software. Formally, the announcement's headline mentions a letter of intent, while the body refers to a "proposed agreement to acquire", so the deal has not closed yet. The price, structure and timeline are not disclosed. AISLE's numbers, however, are impressive: in its first year it found more than 500 vulnerabilities with assigned CVEs across 100+ codebases.

What AISLE showed in its first year

Cohere's main argument is real-world results, not a demo on synthetic benchmarks. According to the company, the system found all 12 vulnerabilities fixed in the January OpenSSL security release, and 18 of the 24 CVEs in the latest curl release. Both projects sit in the foundation layer of the internet, and their maintainers are known for being strict about reports. Cohere says the maintainers themselves independently verified the findings.

AISLE's approach is described as a combination of several components: increasingly capable foundation models, security expertise, large-scale code analysis, rigorous validation and automated remediation. Validation is the key word here. Open source developers have long been irritated by the noise in model-generated vulnerability reports, and a system whose findings are accepted and assigned CVEs addresses exactly that problem.

The metrics from the announcement at a glance:

• company age: founded in 2025;
• more than 500 previously unknown vulnerabilities with CVEs;
• more than 100 codebases;
• 12 of 12 vulnerabilities in the January OpenSSL release;
• 18 of 24 CVEs in the latest curl release.

Why Cohere wants it

Cohere has consistently positioned itself as a provider of sovereign AI for enterprise and government customers, not as a competitor to consumer chatbots. Deployment in private cloud, on-prem and fully isolated (air-gapped) environments is the core of that offering. For such customers, security determines whether a project makes it from pilot to production.

The AISLE acquisition continues Cohere's European line: it previously acquired Reliant AI and partnered with Aleph Alpha. Now a company with cybersecurity expertise joins them. For regulated industries and the public sector in Europe, local control over data combined with an in-house security team looks like a logical package.

There is also a research motive. Cohere writes that the capabilities of a foundation model and of the specialized system built around it reinforce each other. If autonomous vulnerability research is brought closer to model development and training, difficult, verifiable security tasks could become a way to evaluate and improve future models. Vulnerability hunting gives an unambiguous outcome: either the CVE is confirmed or it is not. For coding, that is a rare signal that needs no subjective judgment.

What customers will get and what to watch

Cohere promises five areas of improvement, and all of them are so far described as expected, not ready:

• advanced threat detection for enterprise and government deployments;
• governance, monitoring and observability for AI agents and autonomous processes;
• protection of sensitive data and critical systems;
• secure deployments in private cloud, on-prem and air-gapped environments;
• cyber-resilient systems that can identify and prioritize threats and respond to them.

In practice, this means the following. Teams choosing an agent platform for a regulated environment should wait for the deal to close and ask for specifics: will vulnerability discovery become part of a commercial product or remain an internal research tool, how will agent monitoring features be connected, and does all of it work without internet access. Open source maintainers should watch whether AISLE keeps its current disclosure and validation process after the acquisition. And for those building their own agent pipelines, AISLE offers a metric: count not the number of reports, but the number of confirmed and accepted CVEs.