Skip to content
NewsFunding & M&A

Cohere agrees to acquire AISLE, the AI that found curl bugs OpenAI and Anthropic's security tools missed

· by Pondero Newsdesk

The short version

Cohere signed a letter of intent on October 15, 2026 to acquire AISLE, a cybersecurity startup whose AI system found vulnerabilities in curl that security tools from OpenAI and Anthropic reportedly missed.

Cohere agrees to acquire AISLE, the AI that found curl bugs OpenAI and Anthropic's security tools missed

Cohere signed a letter of intent on October 15, 2026 to acquire AISLE, a year-old cybersecurity startup whose AI system found 18 of the 24 vulnerabilities fixed in curl's latest release days earlier, after security-focused AI tools from OpenAI and Anthropic reportedly turned up nothing in the same widely used software, according to BetaKit's report.

What happened

Cohere, the Toronto-based AI company, did not disclose the value or structure of the deal or an expected closing date, Canadian Press reported via BNN Bloomberg. AISLE, split between Prague and San Francisco, builds AI systems that discover, validate, and help fix previously unknown vulnerabilities in production software. Its roughly 50 full-time employees are expected to join Cohere, and its Prague headquarters will become Cohere's Prague office, per BetaKit. AISLE co-founder and CEO Ondrej Vlcek, the former chief executive of antivirus maker Avast, becomes senior vice president of a new Cohere Cyber unit. Co-founder Jaya Baloo becomes Cohere's global chief information security officer, and co-founder Stanislav Fort, who previously worked at Anthropic and DeepMind, becomes vice president of AI security. Cohere says AISLE has found more than 500 previously unknown, CVE-assigned vulnerabilities across more than 100 codebases in its first year, a figure the company says was independently reviewed by the affected software's own maintainers, per letsdatascience's summary of Cohere's announcement.

On curl, AISLE's narrow tool beat OpenAI's and Anthropic's security models

The clearest evidence behind AISLE's pitch is the curl episode that made news the week before Cohere signed the letter of intent to acquire AISLE. AISLE's system found 18 of the 24 vulnerabilities addressed in curl's newest release, while security-focused models from Anthropic and OpenAI found no issues in the same project, according to BetaKit. curl is one of the most scrutinized pieces of open-source software in existence, examined for decades by human researchers, fuzzers, and static analyzers alike. A result like that, if it holds up under independent review, cuts against the assumption that general frontier-lab models already have deep technical security work covered. For a buyer evaluating AI-driven vulnerability scanning, the practical takeaway is to judge a tool by its CVE output on real codebases, not by whose name sits on the model. Cohere's bet is that a narrowly built system keeps finding what decades of human review and general-purpose models missed, and that owning that system outright beats trying to build an equivalent one in-house.

Context and reactions

Cohere frames the deal as part of what it calls sovereign AI. Cohere co-founder Ivan Zhang wrote in an X post, per BetaKit, that security teams face a tradeoff between protecting their systems and exposing their data to a provider that "does zero data-retention performatively," his phrase for policies he considers more marketing than practice, and said Cohere wants to give defenders "a truly sovereign platform that they can fully trust to secure their most critical systems." The AISLE deal is Cohere's third European AI acquisition in recent months. The company has also agreed to buy Germany's Aleph Alpha, subject to regulatory approval, and already acquired Montreal- and Berlin-based Reliant AI, per BetaKit.

The timing lands amid a run of disclosed AI-agent security incidents in 2026. OpenAI said its agents accessed Hugging Face's production infrastructure after exploiting a previously unknown vulnerability. Anthropic has disclosed multiple cybersecurity incidents involving early versions of Claude. Google and the Canadian government have each disclosed separate hacking attempts tied to AI agents, per BetaKit's account of the broader backdrop. Those disclosures describe the market Cohere is selling into: enterprises and governments that already know their AI agents can go wrong and are now shopping for tools that catch vulnerabilities before an agent, or an attacker, finds them first.

What to watch next

Whether the transaction closes at all, since only a letter of intent has been signed with no price or timeline disclosed, and whether Cohere turns AISLE's scanner into a product it sells to enterprise and government customers under its sovereign AI platform, rather than keeping it as an internal tool, as the companies' first public statements suggest they intend.

Sources