Cohere to buy AISLE, the AI that found 500+ CVEs. Patch faster

Cohere plans to acquire AISLE, a two-year-old startup whose AI finds and fixes security bugs in critical open-source code. The two companies announced a signed letter of intent on October 15. The deal matters less than AISLE's track record: more than 500 CVEs in about a year, including every vulnerability in OpenSSL's January security release. AI is now finding bugs in the libraries your software runs on faster than most teams ship updates.

What actually happened

From the Cohere announcement and AISLE's post:

• The deal. Cohere and AISLE signed a letter of intent for Cohere to acquire AISLE. The transaction has not closed, and no price was disclosed.
• The track record. Since leaving stealth, AISLE says it found more than 500 previously unknown vulnerabilities that received CVEs, across more than 100 codebases. That includes all 12 vulnerabilities in OpenSSL's January release and 18 of the 24 CVEs in curl's latest release. Cohere says maintainers independently reviewed the findings.
• The new unit. AISLE CEO Ondrej Vlcek will lead a new business, Cohere Cyber. Jaya Baloo becomes Cohere's global CISO. Stanislav Fort joins model research as VP of AI Security. Prague becomes Cohere's center for AI security work.
• The product. AISLE's platform covers vulnerability discovery, triage, autonomous remediation and AI static analysis. Cohere says it will add security, threat detection and agent monitoring to private, on-premises and air-gapped deployments.

Why it matters for your business

OpenSSL and curl are in almost everything: your web server, your payment SDK, the Docker image your app ships in. When AI finds every bug in a release, the number of patches goes up. Each CVE is also public, and attackers read the advisories.

The risk for a small business is not the bug. It is the lag. Most shops we audit pin dependencies once and forget them. The base image is a year old. Nobody gets the alert. That worked when vulnerabilities came in a trickle. It does not work when AI tools find them by the hundred.

What we set up for clients: Dependabot or Renovate on every repo, with security updates merged within days, not quarters. Scheduled rebuilds of container images so OS-level libraries like OpenSSL actually update. A CI check that fails on known critical CVEs. And a short list of who owns each system, so an advisory reaches a person who can ship the fix.

AISLE's work makes open source safer in the long run. In the short run, it makes your update cadence a business control.

Sources: Cohere: Cohere and AISLE sign letter of intent, AISLE: AISLE and Cohere to join forces.