AISLE

GAMMA-Ray report · Spectrum 0.2 beta · Public tier · read 2026-11-10 · not reviewed by the company yet

AISLE sells a software platform that uses AI agents to find vulnerabilities in source code, triage them, write and test patches, and deliver them as pull requests for people to merge.

Built only from AISLE's own public pages (product, blog, about, customer stories), third-party vulnerability records (OpenSSL, curl, Samba) and, for company basics only, BetaKit. AISLE has not seen this report. Nothing was tested and no credentials were used. If you are AISLE and something here is wrong or missing, the correction will be made and dated, and you can claim the card to add evidence.

The agentic solutions

One card per solution. Each level is computed from the evidence by a published rule; a dimension with nothing public reads "not yet evidenced", which is not a no. A card rates a product as documented, not anyone's deployment of it.

AISLE platform (AI-native Cyber Reasoning System): Vulnerability Discovery, Vulnerability Triage, Autonomous Remediation, Continuous Improvement

Analyzes connected repositories, verifies and ranks findings, writes patches, tests them in an isolated container and in the customer's CI, and opens pull requests that people merge.

The full card, every answer and its evidence · the governance layer

AISLE Snapshot

A one-time AI code audit that delivers prioritized findings, deployable inside the customer's perimeter. No card yet (available): this solution has not been assessed.

Dependency Firewall (AI package firewall)

A read-only proxy for crates.io, npm and PyPI that checks package requests and blocks malicious packages. No card yet (available (rolled out October 2026)): this solution has not been assessed.

AISLE MCP Server

A read-only MCP server with five tools that lets coding agents such as Claude Code, Codex and Cursor read AISLE findings and fixes. No card yet (announced 9 November 2026; read-only): this solution has not been assessed.

Proof of exploitability for web apps and APIs

With customer authorization, an agent sends targeted requests to a running test application to confirm a finding and attaches the evidence. No card yet (rolled out October 2026 (blog)): this solution has not been assessed.

AISLE analyzer for open source

No-cost use of the analyzer for eligible critical open-source projects, reviewing pull requests (e.g. OpenSSL, curl, OpenEMR). No card yet (available on application): this solution has not been assessed.

Our reading

The shape. The AISLE platform reads A4 · R2 · C1 · O2 (Building). It builds a customer's repository in an isolated container, writes a patch, runs the customer's tests and opens a pull request; it plugs into scanners, repositories and CI. A merge to the main branch always waits for a person on the customer's team.

Where the evidence is strongest. The work is visible outside AISLE's own pages. OpenSSL's vulnerabilities page, curl's machine-readable vulnerability list and Samba's advisory credit AISLE's research team, and AISLE is a CVE Numbering Authority. The card counts what the agent does on its own from a named customer: Productboard rolled AISLE out across all 56 repositories, with automated triage and AI-generated pull requests.

Autonomy 4, as an option. How far AISLE goes is a setting the customer chooses per severity and per repository: stop at triage, or go on to a tested pull request. The page states no default, so Autonomy 4 is marked available.

Control 1, and what would lift it. The merge gate is documented. Level 2 asks for access narrower than the whole account, stated for AISLE itself: a public page on the scopes AISLE asks for when it connects to GitHub, GitLab, Bitbucket or Azure DevOps would meet it. The read-only MCP server limits what other agents can read from AISLE, which is a different thing, and is shown, not counted.

Openness. Data use and the limits of what it fixes are documented, which meets Disclosed and Documented under Spectrum 0.2. Published evaluation results with a method would reach level 3; the headline figures on its pages have none.

For readers. On 15 October 2026 AISLE and Cohere signed a letter of intent for Cohere to acquire AISLE; nothing we read says it has completed.

What would move it

The one piece of public evidence that would lift each card next:

• AISLE platform (AI-native Cyber Reasoning System): Vulnerability Discovery, Vulnerability Triage, Autonomous Remediation, Continuous Improvement: Control 2 (Configurable). Public evidence that what it can reach is enumerated: scopes, permissions, tools.

The agent at work

Examples from public pages that name a customer or give figures. Each source was captured and hashed on the date shown.

OpenSSL Foundation

AISLE's story says the Foundation uses AISLE internally to analyze pull requests and generate fixes, and that AISLE found 20 of 23 OpenSSL CVEs in six months; OpenSSL's own vulnerabilities page credits Aisle Research staff as finders and fix developers. "Now AISLE is analyzing pull requests (PRs), flagging issues, and generating fixes"

Source (captured 2026-11-10T15:46Z, sha256 eb1462934ed8c67f)

OpenSSL (third-party record)

OpenSSL's vulnerabilities page lists Aisle Research staff as finders of multiple CVEs and as fix developers. The credit names a person of AISLE's research team; it shows the team's work, which the card does not count as the agent acting on its own. "Joshua Rogers (Aisle Research)"

Source (captured 2026-11-10T06:54Z, sha256 b8f6515103b07f6f)

curl project

AISLE's story says curl has used AISLE to find and propose fixes since February 2026, with 35 CVEs attributed to AISLE in 12 months; curl's vuln.json credits Aisle Research as finder on 34 CVE entries. "bringing AISLE’s 12-month total to 35 CVEs"

Source (captured 2026-11-10T06:54Z, sha256 a9b30d11d7312a01)

curl (third-party record)

curl's machine-readable vulnerability list credits Aisle Research staff as finders, and in some entries as remediation developers. The credit names a person of AISLE's research team; it shows the team's work, which the card does not count as the agent acting on its own. "Joshua Rogers (Aisle Research)"

Source (captured 2026-11-10T06:54Z, sha256 97e81f9a06590abd)

Productboard

Customer story: rolled out across all 56 repositories, reducing 30,000 alerts to six actionable items, with Jira, Slack and AI-generated pull requests. "Productboard rolled out AISLE across all 56 repositories"

Source (captured 2026-11-10T15:46Z, sha256 b90ab4d495f89124)

Samba (CVE-2025-10230)

Samba's advisory for a CVSS 10.0 WINS hook command injection credits a researcher of Aisle Research. The credit names a person of AISLE's research team; it shows the team's work, which the card does not count as the agent acting on its own. "Reported by Igor Morgenstern of Aisle Research."

Source (captured 2026-11-10T06:54Z, sha256 5ba8380d2c449c67)

The company

• Emerged from stealth on 16 October 2025, datelined San Francisco and Prague. "AISLE today emerged from stealth" Source (captured 2026-11-10T06:54Z, sha256 20d872d1ee49c60e)
• AISLE and Cohere signed a letter of intent for Cohere to acquire AISLE; not stated as completed. "signed a Letter of Intent (LoI) for Cohere to acquire AISLE" Source (captured 2026-11-10T06:54Z, sha256 3d719f8785c2bfd6)
• AISLE refers to its Prague headquarters. "our Prague headquarters will become Cohere's Prague office" Source (captured 2026-11-10T06:54Z, sha256 3d719f8785c2bfd6)
• Legal entities: Aisle Inc. (San Francisco) and Aisle s.r.o. (Prague). "Aisle s.r.o., Jungmannova 750/34, 110 00 Prague 1, Czech Republic" Source (captured 2026-11-10T15:46Z, sha256 13cbb99908547db4)
• About 50 full-time employees, per an AISLE spokesperson quoted by BetaKit (news, October 2026). "approximately 50 full-time employees will all join Cohere" Source (captured 2026-11-10T06:54Z, sha256 d4e66a70222918a2)
• AISLE is a CVE Numbering Authority under ENISA, with scope expanded on 26 August 2026 to third-party software not covered by another CNA. "Designation as a Researcher CNA" Source (captured 2026-11-10T06:54Z, sha256 a80b1b9e5262bce7)
• The site states the platform covers own code, dependencies, secrets, licenses and IaC. "AISLE delivers verified fixes for code and dependency vulnerabilities." Source (captured 2026-11-10T15:46Z, sha256 781c682dd9303d6b)
• Funding amounts were not found on AISLE's site; angel investors are named on the About page. "Angel Investors" Source (captured 2026-11-10T06:54Z, sha256 c2435d6bd46472c3)

The people

Public and professional only, from the company's own pages or a public professional source.

• Ondrej Vlcek, Co-founder and CEO. Source
• Jaya Baloo, Co-founder, COO and CISO. Source
• Stanislav Fort, Co-founder, Chief Scientist (About page); described as CTO and Chief Scientist in AISLE's Cohere post and as CTO by BetaKit. Source

The graph

The company, its people and the stories on the left; each solution, the captured sources behind its card, the indicators those sources evidence and the provisions of the instruments those indicators touch, to the right. "Touched" never means "complies".

The evidence

How this report was made

A researcher-assessor gathered and captured the sources and mapped the evidence to indicators, without assigning a level. A challenger argued against every level three and four and every doubtful credit. The deterministic scorer computed the levels and the gate checked the rules. A card appears here only after two rounds of review and a sign-off by agents that did not write it (the team's workflow); AISLE platform (AI-native Cyber Reasoning System): Vulnerability Discovery, Vulnerability Triage, Autonomous Remediation, Continuous Improvement: reviewed in 3 rounds, signed off by gamma.approve@web-summit.dinis on 2026-11-10. A person's sign-off of the series is still to come.

The vault

Every capture, the dossier, both assessors' mappings, the challenger's notes and this report's data are in a public sgit vault (z11yqwik). Read key:

sgit_public_read_5dcfc650a15adce6282cb5996d1cd2f57f8bd817588886e419e57a94246fdabd:z11yqwik

With sgit: sgit clone followed by the key. The key reads; it cannot write.

Corrections

None yet. A correction is made in place, dated here, and carried to the card, the vault and the article.

The article

AISLE on the GAMMA-Ray Spectrum: A4 · R2 · C1 · O2, written from this report for PrompTugal.news.