Frontier model labs used to buy GPUs and talent. Now they are shopping for bug hunters.
On Oct 15, Cohere said it signed a letter of intent to acquire AISLE, the Prague-based shop building autonomous systems that find and help fix previously unknown vulnerabilities in production software. Terms: Undisclosed. The plan, if the deal closes, is a new Cohere Cyber unit with a long-term investment in Prague as Cohere’s global center for AI cybersecurity.
What AISLE actually shipped. Founded in 2024, AISLE says that in its first year out of stealth it discovered more than 500 previously unknown vulnerabilities assigned CVEs across more than 100 codebases. That includes all 12 vulnerabilities in OpenSSL’s January security release and 18 of the 24 CVEs in curl’s latest release, with maintainers reviewing the findings (per Cohere). Those are not demo CVEs. They are the kind of upstream patches that change how enterprises prioritize libraries they cannot rewrite.
Who sits where. AISLE’s three founders take Cohere leadership seats if the deal lands. Ondřej Vlček becomes Senior Vice President, Cohere Cyber, and leads the new global cybersecurity business. Jaya Baloo becomes Cohere’s Chief Information Security Officer. Stanislav Fort becomes Vice President, AI Security, joining frontier model research and training. That is not a marketing tuck-in. That is an acqui-hire of an offensive research stack into the model company itself.
Read it next to the other rumor. Days earlier, The Information reported OpenAI in early talks to buy Trail of Bits, the New York firm known for open-source vulnerability work and crypto audits. Yahoo Finance’s write-up of that reporting notes Patch the Planet has flagged 1,917 issues across 67 codebases with 462 patches merged upstream. Price: Undisclosed. Status: early talks that can still fall through. Put the two side by side and the pattern is clearer than either deal alone. Labs are not just selling “cyber-capable” models. They are absorbing the teams that prove those models can find real bugs.
Why sovereign AI framing matters. Cohere ties the LOI to Europe after Reliant AI and Aleph Alpha, and to customers that need private cloud, on-prem, and air-gapped deployments. Security is the sales objection that kills enterprise AI rollouts after the pilot. If Cohere can show continuous discovery and remediation sitting next to the model, the pitch shifts from “trust our weights” to “we also hunt what your stack still runs.” That is a platform story. It is also a threat to independent AI AppSec vendors whose differentiation was exactly that hunt.
What is missing. No price. No ARR. No close date. An LOI is intent, not ownership. AISLE’s CVE counts are impressive and should be verified against the OpenSSL and curl advisories themselves before anyone underwrites a multiple. Cohere does not say whether AISLE’s tooling stays customer-facing or folds into internal model evaluation. Ask that question before you decide if this enlarges the pure-play market or shrinks it.
What we’d watch next. A signed SPA, not another blog post. Whether Cohere Cyber sells to outside enterprises or only hardens Cohere deployments. Whether AISLE’s CVE cadence holds after the founders’ calendars fill with platform work. And whether Anthropic, Google, or Microsoft answer with their own research acquisitions instead of partnerships.
The read. Pure-play autonomous vuln discovery just got a new buyer class. When the model vendor owns the hunter, the independent shop has to prove it ships faster, sells cleaner, and stays independent of the lab’s roadmap. Cohere’s LOI is the loudest signal yet that cyber is becoming a first-party lab capability, not a channel category.