Cohere Moves to Buy AISLE as AI Vulnerability Hunting Goes Mainstream

Cohere has signed a letter of intent to acquire AISLE, a startup whose AI systems find and help fix software vulnerabilities, the two companies announced on October 15. AISLE's team will form the core of a new Cohere Cyber unit. The deal arrives in a week that showed both sides of AI-driven bug hunting: the tools are now finding real flaws at scale, and enterprises are discovering that someone still has to fix them. For CISOs and CIOs, that combination is likely to reshape security budgets and staffing.

What is AISLE, and what is Cohere buying?

AISLE came out of stealth about a year ago. In its announcement, the company said its systems have found more than 500 previously unknown vulnerabilities that received CVE identifiers, across more than 100 codebases. It pointed to two widely used open-source projects as proof: AISLE found all 12 vulnerabilities in OpenSSL's January security release and 18 of the 24 CVEs in curl's latest release.

The letter of intent is not a completed deal, and neither company disclosed a price. AISLE said it will share more details as the transaction moves forward. When it closes, AISLE's Prague headquarters becomes a Cohere office. AISLE CEO Ondrej Vlcek, a former Avast chief executive according to AI Weekly, will join Cohere as Senior Vice President of Cohere Cyber. AISLE's Jaya Baloo becomes Cohere's global chief information security officer, and Stanislav Fort will lead AI security research as Vice President, AI Security, working with Cohere co-founder and CTO Ivan Zhang.

AISLE's leaders framed the mission in public-interest terms, writing that their goal is "to defend the software infrastructure our democratic societies depend on." The combined company says it wants to make finding, validating and fixing vulnerabilities a continuous defensive capability rather than a periodic audit.

For Cohere, an AI model company focused on enterprise customers, the purchase adds a security product line. AI Weekly noted that it also extends Cohere's European presence following its merger with Germany's Aleph Alpha.

Why does AI vulnerability discovery matter to enterprises now?

Because the volume is arriving faster than many security teams can absorb it. The same week, AI Weekly reported, citing CNBC, that Bank of America CEO Brian Moynihan told investors the bank added 1,000 contract workers in the second quarter to fix flaws in vendor and in-house software that Anthropic's Claude Mythos model had identified. They work alongside about 3,000 internal staff, and one scan alone flagged more than 23,000 issues, according to the report.

Moynihan said software remediation and anti-money-laundering compliance together added a couple hundred million dollars to third-quarter costs, the report said. He also projected $300 million in AI savings this year, rising to $700 million in 2027.

The Bank of America example captures the new math. Finding a flaw is getting cheap. Triaging it, testing a fix and deploying the patch across a large, regulated estate is still slow, skilled and expensive work. AISLE's own figures show the same funnel: its site lists thousands of findings, a smaller number triaged and fewer still fixed. Discovery tools that do not help with that back half of the process mostly create a longer queue.

How should security leaders respond?

Practitioners at AI Connect events have argued that defense has to move at the same speed as AI-assisted attacks. At COLLIDE 2026, Sundari Parekh, Global Deputy CISO at TrendAI, said "AI-powered defense mechanisms are essential to AI-powered attacks." In her session on defending against AI-driven social engineering, she described human analysts moving up to strategic decisions while agents handle first-line triage. "Gone are the days of the SOC 1 analyst," she said.

That logic applies to vulnerability management too. If attackers can use similar models to find the same flaws, the window between discovery and exploitation shrinks. Enterprise leaders should plan for a few changes:

• Budget for remediation, not just detection. The bottleneck is fixing, as Bank of America's contractor hiring shows. Capacity plans should cover engineering time to patch, test and deploy.
• Start with what is exposed. Prioritize internet-facing systems and widely shared libraries, where a public flaw is most likely to be exploited quickly.
• Press vendors. Many of the issues Bank of America found sat in vendor software. Contracts should set expectations for how quickly suppliers patch AI-discovered flaws.
• Govern the tools themselves. Security agents need broad access to code and systems. As Rubrik's Cal Al-Dhubaib warned at The AI Enterprise Conference 2026, AI systems with tool access can overreach in ways traditional controls miss.

What to watch next

The questions now are how quickly Cohere closes the deal, whether Cohere Cyber is offered as a stand-alone service or built into Cohere's enterprise platform, and whether other model providers follow with security acquisitions of their own. For buyers, the more immediate signal is the Bank of America disclosure. AI can now produce a list of flaws far longer than most organizations have ever had to work through, and the cost of clearing it belongs in next year's plan.

Frequently asked questions

What is AISLE?

AISLE is an AI cybersecurity startup, based in Prague, whose systems find and help fix software vulnerabilities. It says it has discovered more than 500 previously unknown CVEs.

Has Cohere completed the AISLE acquisition?

No. On October 15 the companies announced a letter of intent. Financial terms were not disclosed, and AISLE said more details would follow.

Why is AI vulnerability discovery a challenge for enterprises?

AI tools can find flaws far faster than teams can fix them. Bank of America reportedly hired 1,000 contractors to patch issues an AI model found, showing remediation is now the costly step.

Filed under: Security & Fraud, Agentic AI