Lovable grows to $1.8 B valuation despite security issues

Lovable is a Stockholm-based artificial intelligence startup established in 2023. Although only two years old, the company has moved quickly from formation to product launch and now to a significant growth stage fundraising.

Its sole product, released in late 2024, is a web platform that converts plain language prompts into production-ready software. Lovable markets the service as a "vibe coding" environment and an "AI Software Engineer" that allows anyone, whether a coder or not, to assemble a complete application or website by describing the desired outcome in natural language. The slogan, "the last piece of software," reflects management’s belief that the tool will eliminate most routine programming work.

How Lovable Works

A user writes a short prompt, such as a request for a customer feedback portal or a multiplayer quiz game. Lovable then orchestrates several large language models to create the front-end interface, the back-end logic, a database, and the deployment pipeline. 

The system stitches together code from Anthropic’s Claude, OpenAI’s GPT series, and Google’s Gemini family, but it relies primarily on Claude Sonnet after internal tests showed that this model is the most reliable. The firm built its own benchmark to measure how often a model "hits a wall" during the build process. Claude scored highest, so it serves as the default engine, while the others act as fallbacks. 

The generated project includes two-way GitHub synchronization, Supabase back-end integration, a visual editor, and inline educational snippets that explain what each file does. The stated goal is a twenty-fold productivity gain for professional developers and a zero-to-one path for non-technical founders.

Main Use Cases

First, founders and product managers use the platform for rapid ideation and proof-of-concept work.

Second, small businesses build commercial-grade web products, avoiding the cost of hiring a full development team.

Third, larger organizations create internal tools — dashboards, workflow trackers, lightweight CRMs — without adding to backlogs in their main engineering groups.

Unusually Strong Early Revenue

Within three months of launch, Lovable reported annualized recurring revenue of $17 million and thirty thousand paying customers. Six months in, a public case study by Anthropic quoted $40 million in annual recurring revenue, and by the seventh month, the number had risen to $75 million. 

Management also reports that more than one million people use the platform each month. Lovable is "Europe’s fastest-growing company ever" and the data lends some weight to this claim. The market intelligence outlet Sifted ranked Lovable first on its 2025 B2B SaaS Rising 100 list, an annual survey limited to companies valued below one billion dollars.

Ambitious Financing Plan

Lovable is in the final stages of a round that would raise more than $150 million and imply a valuation of approximately $1.8 billion. Accel is leading the transaction, with prior backers 20VC and Creandum taking pro rata positions. 

The firm last tapped the market six months ago, in February 2025, when Creandum led a $15 million pre-Series A round. People involved in the new deal say the target size and headline valuation were increased during negotiations because investor demand was stronger than expected. 

Both Lovable and Accel have declined public comment, but the consensus among advisers is that the round will close as scheduled on the stated terms.

If completed, the deal would place Lovable among a growing group of multibillion-dollar European AI companies that includes Mistral, Synthesia, DeepL, and Helsing. 

Security Concerns

The company claims that, on average, the end-to-end build process runs twenty times faster than a traditional development cycle.

The speed advantage, however, brings security concerns. A Replit employee published research showing that 170 of 1,645 analyzed Lovable projects exposed personal data, including names, email addresses, financial information, and secret API keys. The root cause was almost always the same: misconfigured Supabase access controls. Because Lovable encourages direct database connections, an error in the rules can leave tables open to the public internet. The vulnerability was entered into the U.S. National Vulnerabilities Database after Lovable’s 45-day remediation window lapsed. 

On the social media site X, the company conceded that it is "not yet where we want to be" on security and promised to improve. It also released a built-in scanner that checks whether Supabase access controls are enabled, though critics note that the tool does not verify whether the rules themselves are correct.

Security specialists argue that letting novice users attach live databases to public applications revives risks long considered solved in professional engineering. 

Insecure vibe coded apps are the single biggest challenge. Former Facebook security chief Alex Stamos says the odds of a beginner configuring permissions correctly are "extremely low." Replit chief executive Amjad Masad adds that any platform making deployment trivial must also make accidental exposure difficult. Analysts draw parallels to the 1990s web era, when dynamic sites multiplied faster than secure coding practices could keep up. The difference now is that attackers can automate reconnaissance with the same AI tools developers use to write code.

Lovable’s leadership says community feedback is integral to its roadmap. An active Discord server acts as a bug report channel, feature request board, and informal support forum. Adoption appears strongest among solo entrepreneurs, small founding teams, and product or design professionals looking to build tangible demos without waiting for scarce engineering resources. The company’s documentation emphasizes that human review remains essential for sensitive deployments, and forthcoming releases will add automated penetration tests, linting for security issues, and one-click migration from the built-in database to managed cloud services with stricter defaults.

Broader Trend

European AI agent start-ups collectively raised €481 million during the first six weeks of 2025, already more than a quarter of the total for all of 2024. 

Competition is emerging on both sides of the Atlantic. In the United States, direct competitor Anysphere tripled its valuation to $9 billion after a $900 million Series B in May 2025. The broader coding assistant field now includes Microsoft, OpenAI, Anthropic, Poolside, Bolt, and Replit, while design software providers Figma and Canva are adding generative AI modules of their own. Investors often cite "vibe coding" as one of the most straightforward ways to monetize large language model technology because it maps directly onto established software team budgets.

Lovable distinguishes itself by aiming squarely at users with little or no coding background. Where Cursor and other incumbents target professional engineers, Lovable promises true no-code operation. The system reads a text brief, proposes an initial architectural outline, asks follow-up questions if necessary, and then emits a running application with authentication, database tables, and deployment scripts already configured. 

2025 as a Pivotal Year

Industry observers view 2025 as a pivotal year for AI-driven software creation. Only about one percent of the global population can write code, yet software needs continue to expand. By pushing large language model capabilities into a no-code package, Lovable aims to widen the pool of "builders" and cut iteration time for professionals. 

Chief executive Anton Osika proposes that engineers will shift from handcrafting features to integrating pre-built blocks and translating user needs into system specifications. He sees further model advances reducing the manual work still required today, though he also argues that human oversight will remain necessary to assure quality, reliability, and policy compliance.

Looking Ahead

Lovable plans to channel the new capital into model research, security hardening, and a push into enterprise accounts. Management believes that combining faster build times with reliable guardrails will appeal to corporate teams that must deliver internal tools under tight budgets. Part of the funding will go toward expanding the platform’s library of pre-configured components and industry templates — health records viewers, logistics dashboards, subscription e-commerce stacks — so users can start from semi-finished blueprints rather than blank pages. The firm also intends to deepen its relationship with Anthropic, arguing that specialized fine-tuning could raise reliability further and open the door to domain-specific variants for finance, healthcare, and education.

Investors frame Lovable as a bet on the application layer of generative AI rather than on foundational models themselves. While Europe has fewer hyperscale compute clusters than the United States or China, its start-up scene has proved capable of building vertical products on top of global model APIs. Lovable’s challenge is to maintain its early lead in usability and speed while closing the gap in security maturity. If it succeeds, the company may demonstrate that world-class AI software firms can scale rapidly outside Silicon Valley. If it falters, competitors with deeper pockets or stronger security postures will absorb the same demand. Either way, the rapid rise of vibe coding tools suggests that natural language programming is moving from experiment to mainstream practice, and Lovable has placed itself at the center of that transition.

The next twelve months will test every dimension of the business. Users will tolerate friction in a young product, but they expect steady evidence that the platform can support production workloads without exposing sensitive data. If Lovable can balance velocity with safety, it will not only shorten build cycles, it could change who gets to participate in software creation and how the industry values the skill of writing code.