Aikido Security, the Belgian application security company, announced on June 30, 2026 that it is acquiring Root, a startup that uses AI agents to write security patches for open-source software. Root was previously known as Slim.AI.
Neither company disclosed the price. Israeli business daily Calcalist estimated the deal at between $70 million and $100 million.
Root's technology has been folded into two new Aikido products, Aikido Libraries and Aikido Images. Aikido said both are already in production and open to all of its customers. Calcalist reported that Aikido will open a development centre in Israel that takes on all of Root's employees, about 25 people.
What Root built
Aikido's announcement framed the problem this way: once a vulnerable open-source package is found, the usual fix is to upgrade it, and upgrades can break production systems, pull in unrelated changes or even bring new vulnerabilities. Even when they go smoothly, Aikido said, they can take weeks of engineering time.
Root took a different route. Its agents produce a patch for a known vulnerability (a CVE) in the specific package version a company is running, rather than asking it to move to a newer release. Aikido described the setup as a kind of factory that turns out hundreds of verified patches a day without breaking changes. The new Aikido products deliver these as drop-in replacement libraries and container images.
Aikido said fixes for actively exploited vulnerabilities will still be contributed back to the open-source projects, and will not be kept for paying customers only. Adrian Estrada, chief technology officer of NodeSource and a Node.js core contributor, said in the announcement that the two companies were taking work off maintainers by backporting fixes and sending them upstream.
“We built Root to skip the argument and just fix the problem in place. This is a choice between walled gardens and real support for open source. We chose open source.”
The founders and the funding
Root started out as Slim.AI, the company behind the open-source Slim Toolkit for container images. Calcalist named its founders as Benji Kalman, Mickey Gordon, Ian Riopel and John Amaral. Riopel is co-founder and chief executive. In Aikido's announcement he said the industry was still stuck on triage, arguing over which items on a long list of CVEs to fix first, or telling teams to throw away their images and start again with another vendor's. Gordon and Kalman told Calcalist that their goal had always been to let organisations keep using the technologies they already depend on.
About 15 of Root's roughly 25 employees work at its development centre in Tel Aviv. Calcalist put the company's total funding at about $31 million, from investors including Insight Partners, Decibel Ventures, Boldstart Ventures, Lema Partners and TechAviv. A separate report citing data from Clay put the total at $37.6 million, including a $31 million Series A in 2022 co-led by Insight Partners and StepStone Group.
Why Aikido is buying
Aikido sells a single platform for scanning code, cloud setups and running applications for security problems. In its announcement it pointed to the speed of attackers, saying AI makes it cheaper to exploit known flaws and that close to a third of known vulnerabilities are exploited on or before the day they are disclosed. It also noted that Log4Shell, found in 2021, still runs in millions of production systems.
Adding Root lets Aikido move from reporting vulnerable dependencies to shipping fixes for them. Aikido said that when a new CVE appears, it will generate a patch for the customer's own system and version.
Aikido raised a $60 million Series B earlier in 2026 at a $1 billion valuation, bringing its total funding to about $85 million, according to Calcalist. It says it serves more than 100,000 teams, including the Premier League, Revolut, SoundCloud and Niantic.
A run of acquisitions
Root is the latest in a series of purchases by Aikido. Calcalist reported that the company had earlier bought Trag, which uses AI to review code, and Allseek and Haicker, two startups working on autonomous penetration testing.
The Israeli development centre is expected to grow beyond Root's existing team, Calcalist said. Neither company gave a date for completing the deal.
