Lovable, a Stockholm startup that lets anyone build a working app by typing plain English sentences instead of code, raised $400 million in August at a $13.3 billion valuation. That is roughly double what it was worth just eight months earlier. Its annualized revenue has gone from $17 million to somewhere near $600 million in about eighteen months, it now counts 8 million users, and people are creating new projects on it at a rate of about 1 million a week.
Lovable is not alone. Replit is valued near $9 billion with more than 30 million users. Cursor’s parent company, Anysphere, has been valued as high as $60 billion. The category these companies compete in, often called “vibe coding,” is projected to grow from roughly $4.7 billion in 2026 to $12.3 billion by 2027. That is not a niche developer tool anymore. That is real money chasing a genuine shift in who gets to build software.
This article breaks down what actually happened with Lovable’s raise, how the product works well enough to pull in that kind of revenue this fast, what a strikingly small team behind it says about the leverage available to anyone building with AI right now, and the part most coverage of this boom leaves out: real, documented data showing a large share of AI generated apps ship with serious security holes. Both things are true at once, and you need both halves to actually use this moment well.
Key Takeaways
- Lovable raised $400 million at a $13.3 billion valuation in August 2026, with annualized revenue climbing from $17 million to roughly $600 million in about eighteen months and 8 million total users
- The broader no-code AI app building category, alongside Replit, Cursor, and Bolt, is forecast to nearly triple from $4.7 billion in 2026 to $12.3 billion in 2027
- Lovable reportedly hit $30 million in annualized revenue with a team of around 18 people, an unusually small headcount that shows how much leverage AI tools now give a small team or a solo builder
- Independent security research paints a real warning: one August 2026 scan of vibe coded apps found 57% of Supabase backed apps allowed anyone to read their database tables without logging in, and separate studies found AI generated code averages more than four times the vulnerabilities of human written code
- The realistic opportunity here is lower cost, faster experimentation for people testing a product idea, not a shortcut around basic security practices before you handle real customer data
What actually happened with the raise
Lovable’s Series C closed in August 2026, led by Menlo Ventures and Scaleup Europe Fund, bringing in $400 million and pushing the company’s valuation to $13.3 billion. That came just eight months after its Series B, a $330 million round in December 2025 that valued the company at $6.6 billion. Total funding across the company’s rounds now sits close to $1 billion.
The revenue behind that valuation climbed fast and kept climbing. Lovable reportedly reached $17 million in annualized revenue with 30,000 paying customers within its first 90 days after rebranding from an earlier open source project called GPT Engineer in late 2024. From there it moved to roughly $30 million by month four, $100 million by the middle of 2025, and past $500 million by June 2026, with reporting around the Series C putting it near $600 million. However you slice the exact monthly figures across different reports, the direction is the same: a straight line up, fast, for close to two years running.
Founder Anton Osika built the company’s original prototype, an open source tool called gpt-engineer, in mid 2023 while working as a CTO elsewhere. That project picked up more than 50,000 GitHub stars before Osika and cofounder Fabian Hedin turned it into Lovable in late 2024. At the time of its Series A, the company reportedly had around 45 employees. Even accounting for growth since, reporting around its earlier funding rounds pegged Lovable’s annualized revenue per employee at more than $1 million, a ratio that is almost unheard of outside of the current AI wave.
How the product actually works
Lovable’s pitch is simple to describe and genuinely different from older no-code tools like drag and drop website builders. A user describes what they want built in plain English, something like “build me a booking app for a dog walking business with a calendar and payment page,” and Lovable generates real, production grade React and TypeScript code behind the scenes, wired up to a Postgres database through Supabase. An “agent” mode added in mid 2025 lets the AI plan, write, and fix its own code with less back and forth from the user, handling more of a project autonomously than earlier versions could.
That matters because it is not generating a mockup or a template. It is generating an actual working application with a real database, real user accounts, and a real checkout flow if you ask for one, the same categories of software a small development shop might have charged tens of thousands of dollars to build a few years ago. Pricing sits on a tiered subscription, with a free tier for testing ideas, paid plans starting around $25 a month for individuals, and business and enterprise tiers above that for teams shipping more usage.
The honest problem nobody selling this technology wants to lead with
Here is where this stops being a straightforward good news story about accessible technology, and it’s important enough to spend real time on rather than a passing caveat.
An August 2026 security scan by researchers at VibeEval passively examined nearly 31,000 live vibe coded apps and found that 99% had at least one security finding, most commonly missing basic protections. More specifically and more seriously, of the apps built on Supabase, the database service Lovable and several competitors use by default, 57% allowed anyone on the internet to read data out of their tables without ever logging in, and 16% allowed anonymous users to delete or modify data outright. Nearly 400 of the exposed apps in that scan had tables holding people related information, things like user accounts, customer records, or patient data. The same research found roughly 1 in 23 apps had accidentally shipped a private access key or credential in their public code.
That is not an isolated finding. A separate study comparing AI assisted code repositories to human written ones found AI assisted repos averaged 42.3 vulnerabilities each versus 9.6 for human only code, a difference of more than four times. Academic research out of Carnegie Mellon found that while 61% of AI generated code worked correctly on the first try, only about 10.5% of it passed an actual security review. Georgetown’s Center for Security and Emerging Technology found 86% of tested AI generated code samples failed basic cross site scripting defenses. A separate Veracode test found AI models chose an insecure way to build a feature over a secure one 45% of the time when both options were available.
None of this means the tools are broken or that the revenue numbers above are somehow fake. Lovable and its competitors are, by every account, generating genuinely functional applications fast enough and well enough that tens of millions of people are choosing to use them and hundreds of millions of dollars in real subscription revenue is changing hands. What it means is that speed and correctness are not the same thing as security, and right now there is a documented, sizable gap between the two across this entire category, not just one platform.
What this actually means if you want to build something
If you have an idea for a piece of software, a booking tool, a simple marketplace, an internal tool for a small business, a habit tracker, whatever it is, the honest takeaway from Lovable’s growth is that the cost of testing that idea has dropped enormously. A free tier or a $25 monthly plan is a real, low stakes way to see whether an idea works before you spend real money hiring a developer, and the market clearly agrees this works well enough to be worth $13 billion.
The realistic move, based on everything above, looks less like “build it and launch it the same afternoon” and more like this. Use these tools to build and test your idea fast, since that speed is real and well documented. Before you ask real people to create accounts or hand over any payment or personal information, run a basic security check, even a simple one. That can mean asking the AI agent itself to review authentication and database permission settings, checking whether your database tables are set to allow public read or write access by default (a setting worth turning off explicitly rather than assuming it’s handled), and avoiding storing anything genuinely sensitive until you’ve had a second look, whether that’s a technically minded friend or a paid review, especially once you have real users. None of that erases the advantage these tools give you. It just closes the specific, measured gap between “this works” and “this is safe,” which the data above says is a real and common gap right now, not a hypothetical one.
A dose of skepticism on the valuation itself
It’s worth sitting with the multiple being paid here too. At $13.3 billion against roughly $600 million in annualized revenue, Lovable is being valued at somewhere around 22 times forward revenue, a rich multiple even by the standards of the current AI funding environment, and one that assumes this growth rate holds or accelerates rather than plateaus as competition from Replit, Cursor, Bolt, and well funded incumbents intensifies. Revenue growing this fast this early is genuinely rare and worth taking seriously. It is not, on its own, proof that the growth continues at the same pace forever, and repeat funding rounds this close together are also a sign investors are racing to lock in a position before the market decides who the long term winners in this category actually are.
Both things can be true. The underlying shift, more people building real software without traditional coding skills, is genuinely happening and genuinely documented in the revenue and user numbers above. The price being paid for exposure to that shift is a separate question, and one only time will actually answer.
Rich mode — activated. — Nini
Want the next breakdown like this before the headlines catch up? Pop your email in below and I’ll send it your way.
Leave a Reply