# Report: AISLE

> GAMMA-Ray v0.0.155 (beta, for review; every rating is experimental). The GAMMA-Ray beta report on AISLE: AISLE platform (AI-native Cyber Reasoning System): Vulnerability Discovery, Vulnerability Triage, Autonomous Remediation, Continuous Improvement A4 · R2 · C1 · O2; 68 provisions lit, 20 sources captured.
> Page: https://gamma-ray.sgit.ai/reports/aisle/ · Source: data/reports/aisle.json


GAMMA-Ray report · Spectrum 0.2 beta · Public tier · read 2026-11-10 · not reviewed by the company yet

AISLE sells a software platform that uses AI agents to find vulnerabilities in source code, triage them, write and test patches, and deliver them as pull requests for people to merge.

1 solution carded of 6 found 20 sources captured and hashed 68 provisions lit in 8 of 8 instruments 6 examples of the agent at work, with sources

Built only from AISLE's own public pages (product, blog, about, customer stories), third-party vulnerability records (OpenSSL, curl, Samba) and, for company basics only, BetaKit. AISLE has not seen this report. Nothing was tested and no credentials were used. If you are AISLE and something here is wrong or missing, the correction will be made and dated, and you can claim the card to add evidence.

## The agentic solutions

One card per solution. Each level is computed from the evidence by a [published rule](../../spectrum/evidence-map/index.md); a dimension with nothing public reads "not yet evidenced", which is not a no. A card rates a product as documented, not anyone's deployment of it.

### AISLE platform (AI-native Cyber Reasoning System): Vulnerability Discovery, Vulnerability Triage, Autonomous Remediation, Continuous Improvement

Analyzes connected repositories, verifies and ranks findings, writes patches, tests them in an isolated container and in the customer's CI, and opens pull requests that people merge.

AISLE platform a product, as documented SPECTRUM 0.2 BETA · Public tier · 2026-11-10 A4 Autonomy Orchestrates with options on · as shipped not yet evidenced π Moderate · S1·R5·A1 ×3 R2 Reach Integrated π Moderate · S1·R5·A1 ×3 C1 Control Stated π Moderate · S1·R5·A1 ×3 O2 Openness Documented π Moderate · S1·R5·A1 ×3 Draft Stage: Building (9 of 16) In production Standout. Autonomy 4 (Orchestrates): "AISLE plugs into the scanners, repos, and CI you already run" Next unlock. Control 2 (Configurable): public evidence that what it can reach is enumerated: scopes, permissions, tools would get there. Trust. FACT-Ray : 17 facts: 17 π Moderate · found by an agent, captured and hashed, checked by 2 other agents (same model family, shared repository); no human has signed it. Standards constellation. 68 provisions lit across 8 of 8 instruments. Salesforce EAAMM OWASP MCP AAGMM Microsoft NIST AI Act Evidence: 11 sources, captured and hashed · the card's page has the vault's read key · Not reviewed by its vendor yet · correct or claim this card

[The full card, every answer and its evidence](../../spectrum/cards/aisle-platform/index.md) · [the governance layer](../../scans/aisle-platform/index.md)

### AISLE Snapshot

A one-time AI code audit that delivers prioritized findings, deployable inside the customer's perimeter. *No card yet (available): this solution has not been assessed.*

### Dependency Firewall (AI package firewall)

A read-only proxy for crates.io, npm and PyPI that checks package requests and blocks malicious packages. *No card yet (available (rolled out October 2026)): this solution has not been assessed.*

### AISLE MCP Server

A read-only MCP server with five tools that lets coding agents such as Claude Code, Codex and Cursor read AISLE findings and fixes. *No card yet (announced 9 November 2026; read-only): this solution has not been assessed.*

### Proof of exploitability for web apps and APIs

With customer authorization, an agent sends targeted requests to a running test application to confirm a finding and attaches the evidence. *No card yet (rolled out October 2026 (blog)): this solution has not been assessed.*

### AISLE analyzer for open source

No-cost use of the analyzer for eligible critical open-source projects, reviewing pull requests (e.g. OpenSSL, curl, OpenEMR). *No card yet (available on application): this solution has not been assessed.*

## Our reading

**The shape.** The AISLE platform reads A4 · R2 · C1 · O2 (Building). It builds a customer's repository in an isolated container, writes a patch, runs the customer's tests and opens a pull request; it plugs into scanners, repositories and CI. A merge to the main branch always waits for a person on the customer's team.

**Where the evidence is strongest.** The work is visible outside AISLE's own pages. OpenSSL's vulnerabilities page, curl's machine-readable vulnerability list and Samba's advisory credit AISLE's research team, and AISLE is a CVE Numbering Authority. The card counts what the agent does on its own from a named customer: Productboard rolled AISLE out across all 56 repositories, with automated triage and AI-generated pull requests.

**Autonomy 4, as an option.** How far AISLE goes is a setting the customer chooses per severity and per repository: stop at triage, or go on to a tested pull request. The page states no default, so Autonomy 4 is marked available.

**Control 1, and what would lift it.** The merge gate is documented. Level 2 asks for access narrower than the whole account, stated for AISLE itself: a public page on the scopes AISLE asks for when it connects to GitHub, GitLab, Bitbucket or Azure DevOps would meet it. The read-only MCP server limits what other agents can read from AISLE, which is a different thing, and is shown, not counted.

**Openness.** Data use and the limits of what it fixes are documented, which meets Disclosed and Documented under Spectrum 0.2. Published evaluation results with a method would reach level 3; the headline figures on its pages have none.

**For readers.** On 15 October 2026 AISLE and Cohere signed a letter of intent for Cohere to acquire AISLE; nothing we read says it has completed.

## What would move it

The one piece of public evidence that would lift each card next:

- **AISLE platform (AI-native Cyber Reasoning System): Vulnerability Discovery, Vulnerability Triage, Autonomous Remediation, Continuous Improvement**: Control 2 (Configurable). Public evidence that what it can reach is enumerated: scopes, permissions, tools.

## The agent at work

Examples from public pages that name a customer or give figures. Each source was captured and hashed on the date shown.

### OpenSSL Foundation

AISLE's story says the Foundation uses AISLE internally to analyze pull requests and generate fixes, and that AISLE found 20 of 23 OpenSSL CVEs in six months; OpenSSL's own vulnerabilities page credits Aisle Research staff as finders and fix developers. "Now AISLE is analyzing pull requests (PRs), flagging issues, and generating fixes"

[Source](https://aisle.com/customers/openssl) (captured 2026-11-10T15:46Z, sha256 `eb1462934ed8c67f`)

### OpenSSL (third-party record)

OpenSSL's vulnerabilities page lists Aisle Research staff as finders of multiple CVEs and as fix developers. The credit names a person of AISLE's research team; it shows the team's work, which the card does not count as the agent acting on its own. "Joshua Rogers (Aisle Research)"

[Source](https://openssl-library.org/news/vulnerabilities/index.html) (captured 2026-11-10T06:54Z, sha256 `b8f6515103b07f6f`)

### curl project

AISLE's story says curl has used AISLE to find and propose fixes since February 2026, with 35 CVEs attributed to AISLE in 12 months; curl's vuln.json credits Aisle Research as finder on 34 CVE entries. "bringing AISLE’s 12-month total to 35 CVEs"

[Source](https://aisle.com/customers/curl) (captured 2026-11-10T06:54Z, sha256 `a9b30d11d7312a01`)

### curl (third-party record)

curl's machine-readable vulnerability list credits Aisle Research staff as finders, and in some entries as remediation developers. The credit names a person of AISLE's research team; it shows the team's work, which the card does not count as the agent acting on its own. "Joshua Rogers (Aisle Research)"

[Source](https://curl.se/docs/vuln.json) (captured 2026-11-10T06:54Z, sha256 `97e81f9a06590abd`)

### Productboard

Customer story: rolled out across all 56 repositories, reducing 30,000 alerts to six actionable items, with Jira, Slack and AI-generated pull requests. "Productboard rolled out AISLE across all 56 repositories"

[Source](https://aisle.com/customers/productboard) (captured 2026-11-10T15:46Z, sha256 `b90ab4d495f89124`)

### Samba (CVE-2025-10230)

Samba's advisory for a CVSS 10.0 WINS hook command injection credits a researcher of Aisle Research. The credit names a person of AISLE's research team; it shows the team's work, which the card does not count as the agent acting on its own. "Reported by Igor Morgenstern of Aisle Research."

[Source](https://www.samba.org/samba/security/CVE-2025-10230.html) (captured 2026-11-10T06:54Z, sha256 `5ba8380d2c449c67`)

## The company

- Emerged from stealth on 16 October 2025, datelined San Francisco and Prague. "AISLE today emerged from stealth" [Source](https://aisle.com/newsroom/press-releases/aisle-emerges-from-stealth) (captured 2026-11-10T06:54Z, sha256 `20d872d1ee49c60e`)
- AISLE and Cohere signed a letter of intent for Cohere to acquire AISLE; not stated as completed. "signed a Letter of Intent (LoI) for Cohere to acquire AISLE" [Source](https://aisle.com/blog/aisle-and-cohere-to-join-forces) (captured 2026-11-10T06:54Z, sha256 `3d719f8785c2bfd6`)
- AISLE refers to its Prague headquarters. "our Prague headquarters will become Cohere's Prague office" [Source](https://aisle.com/blog/aisle-and-cohere-to-join-forces) (captured 2026-11-10T06:54Z, sha256 `3d719f8785c2bfd6`)
- Legal entities: Aisle Inc. (San Francisco) and Aisle s.r.o. (Prague). "Aisle s.r.o., Jungmannova 750/34, 110 00 Prague 1, Czech Republic" [Source](https://aisle.com/privacy-policy) (captured 2026-11-10T15:46Z, sha256 `13cbb99908547db4`)
- About 50 full-time employees, per an AISLE spokesperson quoted by BetaKit (news, October 2026). "approximately 50 full-time employees will all join Cohere" [Source](https://betakit.com/cohere-to-acquire-czech-ai-cybersecurity-firm-aisle-set-up-new-cyber-division/) (captured 2026-11-10T06:54Z, sha256 `d4e66a70222918a2`)
- AISLE is a CVE Numbering Authority under ENISA, with scope expanded on 26 August 2026 to third-party software not covered by another CNA. "Designation as a Researcher CNA" [Source](https://aisle.com/newsroom/press-releases/aisle-achieves-expanded-scope-as-cve-numbering-authority) (captured 2026-11-10T06:54Z, sha256 `a80b1b9e5262bce7`)
- The site states the platform covers own code, dependencies, secrets, licenses and IaC. "AISLE delivers verified fixes for code and dependency vulnerabilities." [Source](https://aisle.com/platform/autonomous-remediation) (captured 2026-11-10T15:46Z, sha256 `781c682dd9303d6b`)
- Funding amounts were not found on AISLE's site; angel investors are named on the About page. "Angel Investors" [Source](https://aisle.com/about-us) (captured 2026-11-10T06:54Z, sha256 `c2435d6bd46472c3`)

## The people

Public and professional only, from the company's own pages or a public professional source.

- **Ondrej Vlcek**, Co-founder and CEO. [Source](https://aisle.com/about-us)
- **Jaya Baloo**, Co-founder, COO and CISO. [Source](https://aisle.com/about-us)
- **Stanislav Fort**, Co-founder, Chief Scientist (About page); described as CTO and Chief Scientist in AISLE's Cohere post and as CTO by BetaKit. [Source](https://aisle.com/blog/aisle-and-cohere-to-join-forces)

## The graph

The company, its people and the stories on the left; each solution, the captured sources behind its card, the indicators those sources evidence and the provisions of the instruments those indicators touch, to the right. "Touched" never means "complies".

people and stories company solutions 11 sources 17 indicators 68 provisions, by instrument I04: The remediation FAQ states AISLE builds the repository in an isolated container, applies its patch and runs the tests. I08: The page states AISLE writes a patch, runs it against the customer's tests and opens a pull request. I10: The platform page states it plugs into the customer's scanners, repositories and CI. I11: AISLE connects from its own service to the customer's hosted version control systems. I18: The page states AISLE writes and tests a patch and opens a pull request, that the customer decides per severity and repository how far it goes, and that a person on the customer's team merges; no default is stated. I20: The home page states what the system is for: finding, fixing and verifying vulnerabilities in source code. I21: The customer sets how far AISLE acts on its own, per severity and per repository. I22: The page states which findings get guidance instead of a patch, and that a fix breaking tests goes back to the team. I26: AISLE's OpenSSL story states maintainers invoke it by tagging the GitHub handle @aisle-analyzer. Stated by AISLE; the account was not checked on GitHub. I38: A merge to the main branch needs a person on the customer's team; AISLE opens the pull request and waits. I41: The enterprise FAQ states every finding and fix is logged through to the approved pull request, with timestamps and approvers; documented only, not observed. I57: Users can contest a triage decision by explaining why and sending the issue back for re-assessment. I58: The privacy policy lists customer data as code repositories and related data submitted to the service. I67: The enterprise page states a figure for engineering hours saved, and the remediation page gives monthly patch and hours figures; no method is published. I68: The deployment comparison states updates and intel are continuous for Managed SaaS and delivered monthly for private cloud and on-prem; this is an update cadence, with no improvement process described. S1: A customer story names Productboard, which rolled AISLE out across all 56 repositories and integrated its AI-powered pull requests into its workflow; the named customer is what is counted, as the page publishes no count of pull requests or tasks. CVE credits to Aisle Research name staff researchers and are not counted here. S4: AISLE's announcement post, published 9 November 2026, states its MCP server gives a customer's coding agent, such as Claude Code, OpenAI Codex or Cursor, read-only access to AISLE findings through five tools, with sign-in by OAuth or a personal access token. AISLE Ondrej Vlcek Jaya Baloo Stanislav Fort OpenSSL Foundation OpenSSL (third-party record) curl project curl (third-party record) Productboard Samba (CVE-2025-10230) AISLE platform (AI-native Cyber Reasoning System): Vulnerability Discovery, Vulnerability Triage, Autonomous Remediation, Continuous Improvement AISLE platform A4 · R2 · C1 · O2 AISLE Snapshot AISLE Snapshot Dependency Firewall (AI package firewall) Dependency Firewall AISLE MCP Server AISLE MCP Server Proof of exploitability for web apps and APIs Proof of exploitability AISLE analyzer for open source Open-source analyzer aisle.com/platform/autonomous-rem… aisle.com/platform aisle.com/platform/vulnerability-… aisle.com aisle.com/customers/openssl aisle.com/enterprise aisle.com/platform/vulnerability-… aisle.com/privacy-policy aisle.com/deployment/managed-saas aisle.com/customers/productboard aisle.com/blog/announcing-the-ais… It generates and executes code with local or cloud privileges I04 It executes actions itself I08 It works across several domains or systems I10 It connects to external tools or services across a trust boundary I11 The agent works independently; the person approves critical decisions only I18 Its purpose and permitted tasks are stated in writing I20 Its autonomy limits and the tools it may use are defined I21 Its limits and known failure cases are documented for those who use it I22 It has its own identity, separate from any person's I26 High-impact actions need a person's approval I38 Its actions are logged I41 There is a channel to report problems with it or contest its output I57 The data it uses is described I58 Its value is measured I67 It is improved on a regular cycle I68 It is in production: a public source names a customer or gives usage figures for what it does on its own S1 It exposes an agent interface: a published MCP server, an agent card, or an API documented for agents to call S4 Salesforce 18 EAAMM 2 OWASP 9 MCP authorization 1 AAGMM 6 Microsoft 13 NIST AI RMF 16 EU AI Act 3 OWASP, AT4 Code Executing Agent Salesforce, Level 2: Simple Orchestration, Single Domain Salesforce, Level 1, how to advance from Level 1 to Level 2 Microsoft, 200: Repeatable, Business strategy Salesforce, Level 3: Complex Orchestration, Multiple Domain Salesforce, Level 2, how to advance from Level 2 to Level 3 Salesforce, Level 3, how to advance from Level 3 to Level 4 Microsoft, 400: Capable, Business strategy Microsoft, 200: Repeatable, Technology and data OWASP, AT6 Externally Extended Agent NIST AI RMF, GOVERN 6.1 NIST AI RMF, MAP 4.1 EAAMM, L4 Supervisory (survey item Q9) NIST AI RMF, MAP 1.1 NIST AI RMF, MAP 2.1 NIST AI RMF, MAP 3.3 NIST AI RMF, MAP 1.3 EU AI Act, Article 13 OWASP, Maturity Level 1 Experimentation without Guardrails, key enterprise action NIST AI RMF, MAP 2.2 Microsoft, 300: Defined, Business strategy NIST AI RMF, MEASURE 2.5 AAGMM, GD-02 Salesforce, Level 2, how to advance from Level 2 to Level 3 OWASP, Maturity Level 4 Adaptive, Self-Regulating Governance, key enterprise action OWASP, Maturity Level 2 Policy-Defined, Human-in-the-Loop, key enterprise action EU AI Act, Article 14 AAGMM, GD-06 NIST AI RMF, MAP 3.5 Salesforce, Level 3, how to advance from Level 3 to Level 4 OWASP, Maturity Level 0 Unaware and Ad Hoc, key enterprise action OWASP, Maturity Level 1 Experimentation without Guardrails, key enterprise action EU AI Act, Article 12 AAGMM, GD-03 AAGMM, GD-08 NIST AI RMF, MEASURE 3.3 NIST AI RMF, GOVERN 5.1 Salesforce, Level 1, how to advance from Level 1 to Level 2 Salesforce, Level 4, how to maximize value NIST AI RMF, GOVERN 5.2 AAGMM, GD-05 EAAMM, Readiness dimension 2 Salesforce, Level 0, how companies can advance from Level 0 to Level 1 Salesforce, Level 1, how to advance from Level 1 to Level 2 Salesforce, Level 0, how companies can advance from Level 0 to Level 1 Salesforce, Level 0, how companies can advance from Level 0 to Level 1 Salesforce, Level 1, how to advance from Level 1 to Level 2 Salesforce, Level 3, how to advance from Level 3 to Level 4 Salesforce, Level 4, how to maximize value Salesforce, Level 4, how to maximize value Microsoft, 200: Repeatable, Business strategy Microsoft, 300: Defined, AI strategy and experience Microsoft, 300: Defined, Business strategy Microsoft, 400: Capable, Business strategy Microsoft, 400: Capable, AI strategy and experience NIST AI RMF, MAP 1.4 NIST AI RMF, MAP 3.1 Microsoft, 100: Initial, Organization and culture AAGMM, GD-12 Microsoft, 400: Capable, AI governance and security Microsoft, 500: Efficient, Business strategy Microsoft, 500: Efficient, AI strategy and experience NIST AI RMF, MANAGE 4.2 OWASP, Maturity Level 1 Experimentation without Guardrails, key enterprise action NIST AI RMF, MEASURE 4.3 MCP authorization, Authorization (draft) OWASP, Maturity Level 1 Experimentation without Guardrails, key enterprise action Salesforce, Level 3, how to advance from Level 3 to Level 4

## The evidence

| Source | Read | SHA-256 (first 16) |
|---|---|---|
| [aisle.com/](https://aisle.com/) | 2026-11-10T15:46Z | `b44da331375d21e2` |
| [aisle.com/about-us](https://aisle.com/about-us) | 2026-11-10T06:54Z | `c2435d6bd46472c3` |
| [aisle.com/blog/aisle-and-cohere-to-join-forces](https://aisle.com/blog/aisle-and-cohere-to-join-forces) | 2026-11-10T06:54Z | `3d719f8785c2bfd6` |
| [aisle.com/blog/announcing-the-aisle-mcp-server](https://aisle.com/blog/announcing-the-aisle-mcp-server) | 2026-11-10T15:46Z | `8fba9a52b1dcaf4c` |
| [aisle.com/customers/curl](https://aisle.com/customers/curl) | 2026-11-10T06:54Z | `a9b30d11d7312a01` |
| [aisle.com/customers/openssl](https://aisle.com/customers/openssl) | 2026-11-10T15:46Z | `eb1462934ed8c67f` |
| [aisle.com/customers/productboard](https://aisle.com/customers/productboard) | 2026-11-10T15:46Z | `b90ab4d495f89124` |
| [aisle.com/deployment/managed-saas](https://aisle.com/deployment/managed-saas) | 2026-11-10T15:46Z | `3a90cd5d7867f136` |
| [aisle.com/enterprise](https://aisle.com/enterprise) | 2026-11-10T15:46Z | `dff44af85ee36354` |
| [aisle.com/newsroom/press-releases/aisle-achieves-expanded-scope-as-cve](https://aisle.com/newsroom/press-releases/aisle-achieves-expanded-scope-as-cve-numbering-authority) | 2026-11-10T06:54Z | `a80b1b9e5262bce7` |
| [aisle.com/newsroom/press-releases/aisle-emerges-from-stealth](https://aisle.com/newsroom/press-releases/aisle-emerges-from-stealth) | 2026-11-10T06:54Z | `20d872d1ee49c60e` |
| [aisle.com/platform](https://aisle.com/platform) | 2026-11-10T15:46Z | `9ede4e7781a0a527` |
| [aisle.com/platform/autonomous-remediation](https://aisle.com/platform/autonomous-remediation) | 2026-11-10T15:46Z | `781c682dd9303d6b` |
| [aisle.com/platform/vulnerability-discovery](https://aisle.com/platform/vulnerability-discovery) | 2026-11-10T15:46Z | `56f5b867d7f837df` |
| [aisle.com/platform/vulnerability-triage](https://aisle.com/platform/vulnerability-triage) | 2026-11-10T15:46Z | `2c835b20038c8e24` |
| [aisle.com/privacy-policy](https://aisle.com/privacy-policy) | 2026-11-10T15:46Z | `13cbb99908547db4` |
| [betakit.com/cohere-to-acquire-czech-ai-cybersecurity-firm-aisle-set-up](https://betakit.com/cohere-to-acquire-czech-ai-cybersecurity-firm-aisle-set-up-new-cyber-division/) | 2026-11-10T06:54Z | `d4e66a70222918a2` |
| [curl.se/docs/vuln.json](https://curl.se/docs/vuln.json) | 2026-11-10T06:54Z | `97e81f9a06590abd` |
| [openssl-library.org/news/vulnerabilities/index.html](https://openssl-library.org/news/vulnerabilities/index.html) | 2026-11-10T06:54Z | `b8f6515103b07f6f` |
| [www.samba.org/samba/security/CVE-2025-10230.html](https://www.samba.org/samba/security/CVE-2025-10230.html) | 2026-11-10T06:54Z | `5ba8380d2c449c67` |

## How this report was made

A researcher-assessor gathered and captured the sources and mapped the evidence to indicators, without assigning a level. A challenger argued against every level three and four and every doubtful credit. The [deterministic scorer](../../spectrum/pipeline/index.md) computed the levels and the gate checked the rules. A card appears here only after two rounds of review and a sign-off by agents that did not write it (the team's workflow); AISLE platform (AI-native Cyber Reasoning System): Vulnerability Discovery, Vulnerability Triage, Autonomous Remediation, Continuous Improvement: reviewed in 3 rounds, signed off by gamma.approve@web-summit.dinis on 2026-11-10. A person's sign-off of the series is still to come.

| Role | Who |
|---|---|
| researcher-assessor | a sub-agent of gamma.studio@web-summit.dinis |
| challenger | a sub-agent |
| scorer | build/spectrum.mjs |
| analyst, designer, writer | gamma.studio@web-summit.dinis |
| review | gamma.review@web-summit.dinis, 3 rounds |
| sign-off | gamma.approve@web-summit.dinis, 2026-11-10 |

## The vault

Every capture, the dossier, both assessors' mappings, the challenger's notes and this report's data are in a public sgit vault (`z11yqwik`). Read key:

sgit_public_read_5dcfc650a15adce6282cb5996d1cd2f57f8bd817588886e419e57a94246fdabd:z11yqwik

With [sgit](https://sgit.ai/): `sgit clone` followed by the key. The key reads; it cannot write.

## Corrections

None yet. A correction is made in place, dated here, and carried to the card, the vault and the article.

## The article

[AISLE on the GAMMA-Ray Spectrum: A4 · R2 · C1 · O2](article.md), written from this report for PrompTugal.news.