Lovable's $100M ARR in 8 Months: How Stockholm Broke Every Record in Software History

Sweden's vibe-coding startup rewrote the SaaS growth playbook by reaching $100 million in annual recurring revenue faster than OpenAI, Cursor, Wiz, and every other software company ever built.

By Carry and Conquer Publications

The number that stopped the tech world on July 23, 2025 was not just impressive - it was categorically different from anything that had come before it. Lovable, a Stockholm-based startup that lets anyone build full-stack web applications using plain English, announced it had crossed $100 million in annual recurring revenue exactly eight months after earning its first $1 million. The record was not regional. It was not a European milestone with an asterisk. Anton Osika, co-founder and CEO, stated flatly that the growth had outpaced OpenAI, Cursor, Wiz, and every other software company in recorded history. He was right, and the benchmarks bear it out: Cursor took twelve months to reach the same mark, Wiz took eighteen, and Deel, the previous titleholder, needed twenty. Lovable got there in eight, with forty-five employees.

From Weekend Project to the World's Fastest-Growing Software Company

The company that broke every SaaS growth record began as a weekend experiment. In 2023, Anton Osika, a former CERN particle physics intern with a master's in engineering physics from KTH Royal Institute of Technology, built an open-source tool called GPT Engineer in a few spare evenings. The idea was simple: let a user describe software in plain English and have AI generate the codebase. Within weeks, GPT Engineer had more than 50,000 GitHub stars and had become one of the fastest-growing repositories in GitHub history. The viral traction was a signal Osika could not ignore.

His co-founder and CTO, Fabian Hedin, was no ordinary collaborator. At the time, Hedin was 26 years old, a Stockholm native whose prior technical work had included contributing to Stephen Hawking's communication interface - a detail that captures something of the caliber of person Osika had recruited. Together they had previously worked at Depict.ai, an AI-powered e-commerce product discovery company backed by Tiger Global and Y Combinator, where Osika served as CTO. Depict raised $20 million in funding before Osika left in late 2023 to focus full-time on what would become Lovable.

Before Lovable, Osika had also spent time at Sana Labs, the AI learning platform, as its first engineering hire, and had founded Stockholm AI, a community he helped build into one of the city's most important hubs for technical talent. By the time he launched Lovable, he was not a first-time founder stumbling through product-market fit. He was a serial entrepreneur with a precise theory of what software creation should look like and the technical depth to execute it.

The commercial product launched at the Slush conference in Helsinki in November 2024 under the name Lovable - a deliberate rebrand from GPT Engineer App, which had seen two failed launch attempts earlier that year. The team had concluded that the "GPT" framing anchored users to a utility rather than a product, and that the ambition required a name that matched the mission. The mission, as Osika states it: to build the last piece of software humanity ever needs to write by hand.

The Eight-Month Sprint: A Revenue Timeline That Does Not Exist in Normal SaaS

The trajectory that followed the November 2024 launch has no real comparator in software history. Within four weeks, Lovable had reached $4 million ARR. By the end of January 2025 - two months after launch - the company crossed $10 million ARR with a team of fifteen people. In February, the ARR stood at $17 million. By June, Osika announced $75 million in ARR. On July 23, 2025, one week after the company became a unicorn with its $200 million Series A led by Accel at a $1.8 billion valuation, Lovable crossed $100 million.

The metrics behind the headline were equally striking. By the time of the $100 million announcement, the platform had more than 2.3 million active users, of which 180,000 were paying subscribers. More than 10 million projects had been created on Lovable since launch, with 100,000 new projects being started every day. At 45 employees generating $100 million in ARR, Lovable was producing approximately $2.2 million in revenue per employee - a ratio that would have been considered impossible in pre-AI SaaS.

The Product: Building for the 99 Percent

What Lovable actually built is deceptively simple in description. A user types what they want - "build me a SaaS tool for managing restaurant reservations with user authentication and a payments integration" - and Lovable generates a full-stack web application with a working frontend, backend logic, database integration via Supabase, and deployment via Cloudflare. No code required. The application is editable through further natural-language prompts, and users can see a live preview as the AI builds.

Osika describes the target market with a single statistic: less than 1 percent of the world's population can write code. The 99 percent who cannot are the customer. What Lovable offers them is not a prototype generator or a mockup tool - it is production-grade software that enterprise customers like Klarna, HubSpot, and Photoroom have moved into live workflows. When Lovable launched its Business Plan tier with single sign-on, private projects, and enterprise data controls, it was not aspirational. It was a response to demand already present in the user base.

The technical architecture running beneath that simple interface is more sophisticated than it appears. Lovable uses multi-model AI orchestration, routing different types of tasks to different foundation models based on complexity and speed requirements. The primary workhorse for code generation is Anthropic's Claude. Simpler tasks - CSS adjustments, copy edits - are routed to faster models. In late 2025, Osika noted publicly that Lovable was also using GPT-5 for certain debugging tasks, where its reasoning capabilities proved superior. The system does not commit to any single provider. It commits to the best tool for each job.

The July 2025 launch of Lovable Agent marked a significant architectural shift. The agentic system moves away from one-shot code generation - submit a prompt, receive code - toward a multi-step reasoning loop that interprets requests, explores the codebase, identifies gaps, makes changes, fetches external documentation, queries databases, and iterates until the result matches intent. Error rates dropped by 91 percent with the agent mode. The gap between "AI that helps developers" and "AI that is a developer" narrowed considerably.

The Growth Engine: Open Source, Community, and Deliberate Simplification

Lovable never spent money on paid acquisition. The growth engine ran on three compounding systems that Anton Osika and his team designed explicitly, not accidentally.

The first was open-source credibility. GPT Engineer's 52,000-plus GitHub stars gave Lovable a pre-built audience of technically minded users who had already validated the core concept before the commercial product launched. That community carried trust into the product launch in a way that paid marketing cannot manufacture.

The second was community infrastructure. Lovable built the Lovable Makers Discord server, which grew to more than 87,000 members. The community became a self-sustaining support and distribution system. Weekly "Ship Saturday" events - open build-a-thons that anyone could join - kept the user base engaged and producing shareable content. When users built something impressive on Lovable and posted it publicly, they were doing Lovable's marketing for it.

The third, and most counterintuitive, was deliberate simplification at the cost of short-term revenue. In June 2025, Osika announced that Lovable had lost $1.5 million ARR in a single day - not from churn or a technical failure, but because the company had voluntarily moved all Team tier subscribers to the Pro tier at a 20 percent lower price point, adding collaboration features without increasing cost. The logic was classic product-led growth: maximize the number of users having exceptional experiences, and revenue will follow. The following month, Lovable crossed $100 million ARR. The same simplification logic drove the backend infrastructure move from Python to Go. Co-founder Fabian Hedin noted that the Go backend handles 1.8 billion tokens per minute at peak load - a throughput level that had broken the previous Python architecture.

The Critical View: Security Debt in a No-Code World

The speed of Lovable's growth produced a shadow that followed the headline numbers into 2025. In March of that year, security researcher Matt Palmer, then at Replit, identified a critical vulnerability in Lovable-generated applications. The issue - assigned CVE-2025-48757 with a CVSS severity score between 8.26 and 9.3 - stemmed from the platform's default handling of Supabase database integrations. When Lovable generated applications that connected to Supabase, it frequently failed to implement Row Level Security policies, which determine which database rows any given user is permitted to access. Without those policies, a public API key embedded in the client-side code became, effectively, an open door to the entire database.

Palmer's initial investigation found that by simply modifying a network request to use a wildcard select query, he could extract all data from vulnerable tables - including emails, phone numbers, payment records, and developer API keys - without authenticating. He and a colleague then built an automated script to scan the showcase sites listed on Lovable's public discovery page. Of 1,645 Lovable-built applications they examined, 170 had critical vulnerabilities. The exposed data across those sites included personal debt information, home addresses, and Stripe payment statuses.

Palmer disclosed the vulnerability privately to Lovable on March 21, 2025. Lovable's initial response - denying the issue, then deleting the relevant tweets - did not inspire confidence. A Palantir engineer independently discovered and publicly disclosed the same vulnerability in April. Lovable responded with a "security scanner" tool in its Lovable 2.0 release on April 24, but the scanner only checked for the presence of an RLS policy, not whether that policy was correctly configured. A false sense of security may have been worse than no scanner at all. The CVE was ultimately published on May 29, 2025, after the standard 45-day coordinated disclosure window closed without a complete fix.

Later incidents compounded the pattern. A security researcher named Taimur Khan found 16 distinct vulnerabilities in a Lovable-hosted education application that had been featured on Lovable's own Discover page with more than 100,000 views. Six of those vulnerabilities were critical. The AI had generated authentication logic with inverted access controls - locking out legitimate users while allowing unauthenticated attackers to read student records, alter grades, and extract admin credentials. The exposed data covered 18,697 users, including students from UC Berkeley and UC Davis.

The security story is not unique to Lovable. A 2025 study by security firm Escape scanned more than 5,600 applications built on vibe-coding platforms including Lovable, Bolt.new, and Create.xyz, and found over 2,000 vulnerabilities and more than 400 exposed API keys across the sample. Veracode has separately documented that AI-generated code contains approximately 2.74 times more security vulnerabilities than human-written code. The structural problem is this: Lovable democratizes building software for people who, by definition, do not have the security expertise to audit what the AI produces.

What Comes After $100 Million

The $100 million ARR milestone was not Lovable's ceiling - it was its floor. In November 2025, the company disclosed it had reached $200 million ARR, having doubled in the four months following the July announcement. In December, a $330 million Series B led by CapitalG, Google's growth investment fund, and Menlo Ventures valued the company at $6.6 billion. The round drew participation from Khosla Ventures, Salesforce Ventures, Databricks Ventures, Nvidia Ventures, HubSpot Ventures, Atlassian Ventures, and DST Global - a investor roster that reads less like a Series B and more like a who's-who of enterprise software infrastructure.

The valuation trajectory is its own kind of record: $1.8 billion in July, $6.6 billion in December. A more-than-tripling in five months. At 26, Fabian Hedin became one of Europe's youngest self-made billionaires. Anton Osika, 35, reached an estimated net worth of $1.6 billion. Both publicly committed to using a significant share of that wealth toward ensuring a safe transition to superintelligent AI.

Osika has been consistent throughout the growth cycle about where Lovable is headed. The company is opening offices in Boston and San Francisco to pursue U.S. enterprise customers and talent. The product roadmap moves toward deeper third-party integrations, native database and payment infrastructure, and the kind of enterprise reliability that allows Fortune 500 teams to use Lovable not as a prototype shortcut but as a core development platform. More than half of Lovable's enterprise accounts reportedly originated when an individual employee discovered the product, built something with it, and brought it to their organization.

The question that hangs over the next phase is the same one the security vulnerabilities surface: can a company built for non-technical users give those users the consequences of technical decisions? Lovable's platform makes it trivially easy to deploy production software. It does not automatically make the person deploying it capable of understanding what they have deployed. That gap - between the accessibility Lovable enables and the accountability it requires - may be the defining design problem of the vibe-coding era. Lovable is the fastest company in history to reach $100 million. The harder record to break is building a platform where speed and safety arrive at the same time.