Cohere Signs Letter of Intent to Acquire Prague Cybersecurity Startup AISLE

Canadian artificial intelligence lab Cohere said on October 15, 2026 that it had signed a letter of intent to acquire AISLE, a cybersecurity startup whose autonomous AI systems hunt for and help fix unknown vulnerabilities in widely used software. Reuters reported on October 15 that the terms of the deal were not disclosed, and that AISLE was described in the announcement as a San Francisco-based company. AISLE itself, in a blog post published the same day, identified its headquarters as Prague, Czech Republic, and said that when the transaction completes, that office will become Cohere's Prague office. Both descriptions point to the same company, which grew out of a European engineering hub while courting customers globally.

The proposed acquisition is not an isolated move. Cohere has been assembling a larger business entity, one that already includes the German AI company Aleph Alpha through a merger announced earlier in 2026. Reuters reported on October 15 that the combination was reported to be worth about $20 billion. Cohere also previously acquired Reliant AI, according to the company's own blog post announcing the AISLE letter of intent. Cybersecurity would be a new vertical for that combined group, aimed squarely at enterprise and public sector clients who want threat detection without handing their data to a hyperscaler.

AISLE is young but unusually visible for its age. Founded in 2024, the company emerged from stealth almost exactly a year before the announcement, according to its founders. BankInfoSecurity reported on October 16 that AISLE employs 50 people and that its angel investors include Google's Jeff Dean, Hugging Face's Thomas Wolf, Datadog's Olivier Pomel and Microsoft's Aparna Chennapragada. The company has been led since inception by Ondrej Vlcek, who spent more than three years running the Czech antivirus maker Avast before it was sold to NortonLifeLock for up to $8.6 billion, BankInfoSecurity reported on October 16.

Under the letter of intent, AISLE's 50 full-time employees would join Cohere, and its three founders would take leadership roles. The arrangement is a letter of intent rather than a completed transaction, so the deal still has to close.

Key Facts

The most concrete measure of AISLE's work is the volume of flaws its systems have surfaced. Cohere's blog post, published on October 15, 2026, said that in its first year out of stealth AISLE discovered more than 500 previously unknown vulnerabilities assigned CVE identifiers across more than 100 codebases. Those included all 12 vulnerabilities in OpenSSL's January security release and 18 of the 24 CVEs in curl's latest release. Reuters reported on October 15 that AISLE said its AI found more than 500 new bugs in widely used software in its first year, including 12 vulnerabilities in OpenSSL, the free program that encrypts internet traffic for banks, governments and messaging apps. AISLE's founders wrote in their own October 15 post that these real-world zero-day vulnerabilities are independently reviewed by the relevant software maintainers, and that the bugs were fixed after their discovery.

The leadership structure is spelled out across the announcements. Ondrej Vlcek, AISLE's chief executive, would become senior vice president of a new unit called Cohere Cyber, leading the newly established global cybersecurity business. Jaya Baloo, AISLE's chief operating officer, would become Cohere's chief information security officer. Dr. Stanislav Fort, who led AISLE's AI cybersecurity research and engineering as chief technology officer and chief scientist, would become vice president of AI security, working with Cohere co-founder and chief technology officer Ivan Zhang to connect security research with core model development and training, according to AISLE's post.

Cohere framed the move as an investment in Europe. Reuters reported on October 15 that the company said the acquisition reflected its continued investment in Europe and would deepen its presence across the region, strengthening European AI. Cohere's blog post said it plans to make a substantial long-term investment in Prague, expanding AISLE's existing presence and establishing the city as its global center for AI cybersecurity and autonomous security systems.

The technical scope is broad. Cohere said the combined capabilities are expected to improve security and threat detection across enterprise and public sector deployments, strengthen governance for AI agents, and support secure AI deployments across private cloud, on-premises and fully air-gapped environments. Reuters reported on October 15 that private deployment would be available on the customer's own system. BankInfoSecurity reported on October 16 that AISLE customers want model choice, data and control locality, and deployment flexibility around bring-your-own-cloud, on-premise and air-gapped setups, according to Baloo.

One product detail stands out: BankInfoSecurity reported on October 16 that AISLE's in-development package firewall identifies and blocks malicious packages in CI/CD pipelines and is in testing with design partners. Baloo also told the publication that AISLE will stay committed to benchmarking models from providers other than Cohere, and that the company would have happily continued as an independent organization.

Analysis

What this really means is that Cohere is buying a capability it cannot quickly build from scratch, and buying it in the place where European regulators and customers increasingly want it to live. Vulnerability discovery at the scale AISLE describes is not a generic large-language-model feature. Finding more than 500 previously unknown flaws across more than 100 codebases, including 18 of the 24 CVEs in a single curl release and all 12 in OpenSSL's January security release, requires a system tuned for code reasoning and validation, plus a process for getting maintainers to accept the findings. Cohere gets that process, a Prague engineering hub and a founding team with a track record, and it gets them without disclosing a price.

The bigger picture here is that sovereign AI has quietly become a cybersecurity argument. Cohere's customers, especially in the public sector, do not simply want a chatbot. They want models that run in their own environments, on their own terms, with an auditable security story attached. Cohere's blog post explicitly lists private cloud, on-premises and fully air-gapped deployments, and Reuters reported on October 15 that the deal aims to boost the combined group's security and threat detection capabilities for enterprise and public sector clients, with private deployment available on the customer's own system. Pairing that deployment model with an autonomous vulnerability hunter is a coherent pitch: the AI you run locally is also the AI that watches the software you run locally.

There is also a recruiting and credibility dimension. Ondrej Vlcek built Avast into one of the best-known European security brands before its sale to NortonLifeLock for up to $8.6 billion, and Jaya Baloo is a well-known chief information security officer in European security circles. Their names give Cohere instant standing with buyers who may never have considered a Canadian AI lab for security work. The addition of AISLE's 50 full-time employees, per BankInfoSecurity on October 16, is small in absolute terms but concentrated in exactly the skills the new unit needs.

The sceptical reading is that a letter of intent is not a closing. No price was disclosed, integration risk is real, and AISLE has publicly committed to remaining model agnostic, which limits how much Cohere can immediately monetize the acquisition as a funnel for its own models. Cohere has also been consolidating: Reliant AI, then Aleph Alpha, now AISLE. Each step adds headcount, geographies and product lines that must eventually cohere, so to speak, into one commercial story. The $20 billion figure attached to the Aleph Alpha combination, as reported by Reuters on October 15, sets a valuation bar that the enlarged group will have to justify with revenue rather than announcements.

Why It Matters

Europe has spent years trying to build domestic AI and security capacity, and the Cohere and AISLE pairing is a live test of whether that capacity can be assembled through consolidation rather than grown organically. Both companies are positioning the deal as a European story: a Canadian lab with a German merger partner adding a Czech-founded security team, with the Prague office named as the global center for AI cybersecurity and autonomous security systems. Reuters reported on October 15 that Cohere said the acquisition would strengthen European AI, language that reads as much as a policy signal as a product statement.

The security stakes are concrete. The flaws AISLE targets sit inside software that banks, governments and messaging apps depend on, and OpenSSL in particular is the encryption layer beneath a huge share of internet traffic. When Reuters reported on October 15 that AISLE found 12 vulnerabilities in OpenSSL, the point was not the count alone but that the code in question is exactly the kind that attackers value. Autonomous discovery shifts the economics of finding such flaws, potentially toward defenders who can scan more code faster.

For buyers, the deal also raises a governance question. If the same vendor supplies the model, the deployment platform and the security tooling, customers will want clear lines around benchmarking and model choice. AISLE's public commitment to continue benchmarking models from providers other than Cohere, reported by BankInfoSecurity on October 16, is an early attempt to answer that concern before it hardens into an objection.

Next Up

The immediate step is closing. The announcements describe a letter of intent, not a completed purchase, so the transaction must still be finalized and Cohere Cyber must be stood up with Vlcek as senior vice president, Baloo as chief information security officer and Fort as vice president of AI security. AISLE said its focus for customers and partners remains continuity and stronger products, which suggests existing contracts and benchmarks carry over for now.

Longer term, watch whether AISLE's package firewall moves from testing with design partners into general availability, whether the Prague hub grows beyond the 50 people joining from AISLE, and whether Cohere's security push extends to its merged Aleph Alpha business. If it does, the roughly $20 billion combination will be judged less on its size than on whether sovereign, private and air-gapped AI can also be secure AI.