Lovable's $300M Fundraising at $13.2B Valuation: Growth, Investors, and the Security Risk That Could Change Everything

Lovable, the Swedish startup that lets anyone build a full-stack web app by typing a sentence, is closing in on its next leap: a $300 million fundraising round that would value the company at $13.2 billion. That is exactly double the $6.6 billion valuation it commanded just six months ago, in December 2025 . But as the company races toward the largest round in the nascent vibe-coding category, a parallel story is unfolding around security vulnerabilities that could reshape the deal — and the industry.

Fundraising Status: Not Yet Closed

On July 8, 2026, Sifted broke the exclusive that Lovable is in talks to raise $300 million at a $13.2 billion post-money valuation, with Menlo Ventures expected to lead the round . TechCrunch and other outlets confirmed the report . As of the most recent reports, the round has not formally closed. If it does so at these terms, Lovable will have doubled its price tag in roughly six months .

For context, the company's Series B in December 2025 raised $330 million at a $6.6 billion valuation, led by CapitalG (Alphabet's venture arm) and Menlo Ventures' Anthology fund, with participation from NVentures (Nvidia), Salesforce Ventures, Databricks Ventures, and others .

Founding and Company Background

Lovable was founded in 2023 in Stockholm, Sweden, by Anton Osika (CEO) and Fabian Hedin (CTO) . The product launched as GPT Engineer, an open-source project Osika released in mid-2023 that garnered roughly 50,000 GitHub stars before being commercialized and rebranded to Lovable in December 2024 . The rebrand signaled a shift from developer tooling to a broader non-technical audience .

CEO Anton Osika previously worked on particle physics at CERN and was the first employee and engineer at Swedish AI unicorn Sana Labs . Both co-founders became billionaires after the December 2025 round, at age 35 and 31 respectively, with Forbes estimating each held roughly 24% of the company .

Product Capabilities

Lovable is an AI-powered "vibe coding" platform that generates full-stack web applications from natural-language prompts. A user describes an idea in plain text, and the AI builds a working app — complete with front end, back end, and database — in seconds . It targets non-technical founders, solo entrepreneurs, and teams who want to prototype and ship full-stack apps without writing code .

Revenue Milestones: The Fastest SaaS Growth in History

Multiple sources describe Lovable's growth as unprecedented in software history :

• $10M ARR in 60 days with just 15 employees .
• $100M ARR in 8 months, faster than OpenAI, Cursor, and Wiz .
• $400M ARR by February 2026 with approximately 146 employees .
• $500M ARR (annualized) by mid-2026, confirmed at the time of the Series B close .

The company tripled its revenue between its earlier round and the December 2025 Series B .

Headcount and Team

By February 2026, Lovable employed approximately 146 people to support a $400 million ARR run rate . The company describes itself on LinkedIn as "a small European team of serial founders, product engineers, physicists, competitive programmers" .

Investor Lineup

Lovable has accumulated a blue-chip investor list across its funding rounds:

Investor	Type	Role
CapitalG	Alphabet's VC arm	Series B lead
Menlo Ventures (Anthology fund)	US VC	Series B co-lead; expected to lead new $300M round
NVentures	Nvidia's VC arm	Series B participant
Salesforce Ventures	Corporate VC	Series B participant
Databricks Ventures	Corporate VC	Series B participant
T.Capital	Deutsche Telekom VC	Series B participant
Atlassian Ventures	Corporate VC	Series B participant
HubSpot Ventures	Corporate VC	Series B participant
Khosla Ventures	VC	Series B participant
Accel	VC	Series B & earlier
Creandum	VC	Series B & earlier

Sources:

Competitive Positioning in the Vibe-Coding Space

Lovable operates in the fast-growing vibe-coding market, which hit an estimated $4.7 billion in 2026, with 63% of users being non-developers .

The competitive landscape includes Cursor, Bolt.new, Replit Agent, v0 (Vercel), Windsurf, and Claude Code .

According to Upwork demand data from January 2025 to April 2026, Lovable was mentioned in 6,243 job posts versus Cursor's 5,373 — making them the clear #1 and #2, far ahead of Bolt and Replit . Lovable mentions grew 627% over the period .

Industry consensus positions Lovable as the best tool for non-technical users who want full-stack apps from a single prompt, while Cursor dominates professional engineer-supervised coding, and Bolt.new is seen as strong for demos but fragile under real complexity .

However, Lovable is consistently rated as "not enterprise-ready" — it lacks SOC 2, ISO, and HIPAA certifications — compared to platforms like Clarista, which limits its upmarket expansion .

Security Concerns: The Biggest Unresolved Risk

This is the most significant unresolved risk for the pending $300 million round — and for the broader vibe-coding category. Three documented security incidents hit Lovable in 2026, all publicly acknowledged.

The 48-Day Exposure (February 3 – April 20, 2026)

A BOLA (Broken Object Level Authorization) vulnerability allowed any authenticated user to read the source code and AI chat histories of public projects on the platform. Lovable acknowledged the bug was reported through its bug bounty program, but the fix was not deployed until 48 days later, after a security researcher publicly disclosed the issue . Lovable's postmortem stated that "private projects and Lovable Cloud were never impacted" . The company attributed the issue to a backend regression in February that re-enabled public access while unifying permissions .

Compounding Incidents

A total of three documented security events exposed source code, database credentials, and thousands of user records . A February 2026 security assessment found 16 vulnerabilities, 6 of them critical, including authentication logic that was "literally backwards — it blocked logged-in users and let anonymous ones through" .

Systemic Category Risk

Multiple security researchers note that AI code generators like Lovable, Bolt, Replit Agent, v0, and Cursor routinely produce code that "looks fine but lacks RLS policies, leaks credentials in browser bundles, and skips webhook signature verification" — because the AI optimizes for code that runs, not code that is safe . New attack classes like "TrustFall" and "CLI-Anything" specifically target AI coding agents .

A first-quarter 2026 assessment by security firm GuardMint found that 91.5% of vibe-coded apps had at least one AI-traceable vulnerability . Georgia Tech's Vibe Security Radar project tracked 35 CVEs attributable to AI coding tools in March 2026 alone, with researchers estimating the true count is five to ten times higher .

Impact on the Deal

As of the most recent reporting, the security incidents have not derailed the reported $300 million talks — Menlo Ventures is still expected to lead the round . However, these issues remain the primary due diligence concern. If a further major breach occurs before close, terms could shift or the round could be delayed. For the broader vibe-coding category, these incidents have triggered increased scrutiny from enterprise buyers and regulators, and several competitors are racing to differentiate on security posture through SOC 2 compliance, RBAC, and audit logs .