Cohere has signed a letter of intent to acquire AISLE, a Prague-based startup that builds autonomous systems for finding, validating and helping to remediate software vulnerabilities. The proposed transaction would add a specialised security layer to Cohere’s sovereign-AI platform; it is not yet a completed acquisition, and the companies did not disclose financial terms.[1][2]
The timing is tied to a measurable open-source result. AISLE says 18 of the 24 vulnerabilities assigned CVE identifiers in curl’s latest security release came from one of its audits. That is 75% of the release total. It is an unusually concrete number for an AI-security company—but it needs the right denominator: accepted findings in that release, not 75% of every vulnerability that existed in curl.[3][4]
What the 18-of-24 result actually contains
A CVE count compresses very different engineering failures into one number. The curl advisories include a proxy-credential leak, a TFTP transfer-direction error and a stack-overflow risk caused by deeply recursive MIME structures. Each involves a different protocol path, precondition and remediation. The value of the audit is therefore not just that a model emitted warnings, but that maintainers could reproduce, classify and patch distinct defects.[5][6][7]
Three accepted findings show why one CVE count is not one kind of bug
| Example | Failure mechanism | Why validation matters |
|---|---|---|
| Proxy credentials | A connection path could disclose credentials to the wrong proxy | The report has to establish the exact redirect and authentication conditionsSource 5 |
| TFTP transfer direction | A direction mismatch could make curl handle a transfer incorrectly | A useful finding must identify the protocol state that triggers the errorSource 6 |
| Recursive MIME structure | Excessive nesting could exhaust the stack | The reproducer has to separate a real parser limit from a theoretical concernSource 7 |
The product is a system around the model
AISLE describes a pipeline that combines foundation models, large-scale code analysis, security expertise, validation and automated remediation. That distinction matters. A language model can suggest that a code path looks suspicious; a security system must also build the relevant context, test whether the condition is reachable, reduce false positives and produce evidence that a maintainer can act on.[1][4]
Cohere’s strategic argument is that hard, verifiable security work can improve both sides of the combination. AISLE would gain closer access to frontier-model development, while Cohere would gain a security team and tooling that can run in private, on-premise or air-gapped environments. Reuters reported that AISLE’s staff would join Cohere and that founder Ondrej Vlcek would lead the combined cybersecurity unit.[1][2]
What the deal does not prove
The release statistics do not establish that the system will find three quarters of flaws in another project, or that all reported CVEs were severe. Open-source codebases differ in language, architecture, test coverage and maintainer process. AISLE’s broader claim of more than 500 CVEs across more than 100 codebases is a company-reported track record, even where individual maintainers independently review particular findings.[1][3]
Sources & further reading
- Cohere and AISLE sign letter of intent to advance cyber-resilient sovereign AI Cohere · 15 Oct 2026 · Accessed 15 Oct 2026
- Cohere moves to buy AI cybersecurity startup AISLE Reuters · 15 Oct 2026 · Accessed 15 Oct 2026
- AISLE AI security platform discovers 75 percent of CVEs in latest curl release AISLE · 14 Oct 2026 · Accessed 15 Oct 2026
- One AISLE curl audit produced 24 CVEs; 18 ship today AISLE · 14 Oct 2026 · Accessed 15 Oct 2026
- CVE-2026-86414: proxy credential leak curl project · 14 Oct 2026 · Accessed 15 Oct 2026
- CVE-2026-92389: TFTP direction confusion curl project · 14 Oct 2026 · Accessed 15 Oct 2026
- CVE-2026-92391: MIME recursion stack overflow curl project · 14 Oct 2026 · Accessed 15 Oct 2026