Hackers’ offensive power has reached an extreme, pushing platforms that let non-coders build apps with artificial intelligence (AI) to step up their defenses.
On November 2, apparent cyberattacks set freezers at some ICA and Coop supermarkets in Sweden to 50°C, ruining their stock. Stores in Belgium, Luxembourg and Estonia were also hit. Less than two weeks earlier, PHP, which runs about 70% of websites, rushed out patches for two critical flaws that researchers had found with AI tools.
“We’re in this era where offensive capabilities have risen to an extreme, and for us, it requires that we put the same defensive capabilities in place,” said Fabian Hedin, co-founder and chief technology officer of Lovable.
“When you’re creating millions of projects every week, there will be a lot of bad actors that want to do something bad with the platform, or good actors who might be targeted by hackers. As a platform, we have a lot of responsibility in making sure that whatever you create on the platform is safe and secure,” he said.
Hedin, who is Swedish, said he had read about the supermarket attacks in that morning’s newspaper at his hotel.
In May, Israeli security firm RedAccess said about 5,000 apps made with AI app builders such as Lovable exposed sensitive data on the open web, including medical and financial records, and found Lovable-built phishing sites imitating brands such as FedEx. The platforms disputed parts of the findings.
He said Lovable runs free scans to find flaws before attackers do, and may force some users to use them.
The company also subsidizes anything users do to make their apps more secure, he said. Many of them have never learned to code.
“We see it as a shared responsibility with the user, where we have to take a lot of proactive actions to ensure that our users are educated and thinking about this, even though they don’t come in with that background. It’s fundamentally a very hard problem,” he said.
Lovable, based in Stockholm, lets people build websites, internal tools and apps by typing prompts in plain language, a practice known as vibe coding. Its annualized revenue passed $600 million in September, up from about $500 million in June.
Open models catch up
Hedin spoke at Bloomberg Tech London, organized by Bloomberg, on November 3 in a fireside chat titled “When Anyone Can Build Software.” Shirin Ghaffary, an AI reporter at Bloomberg, moderated the session, which also covered AI model costs and the future of business software.
He said Lovable evaluates AI models in real time so it can route each request to whichever suits it best.
“Open source historically hasn’t been competitive with the frontier. But in recent months, they’ve advanced a lot, where it’s very competitive on cost and latency, and also quite competitive on quality,” he said.
Lovable draws on models from Anthropic, OpenAI and Google’s Gemini, along with its own models tuned from open-source ones. Billions of tokens, the units of text that AI models process, flow through its system every minute.
Hedin said AI labs are largely tied to their own models, though some have begun using open-source ones. He said simple tasks go to smaller, faster and cheaper models, which lowers the price users pay, and the right balance of cost, latency and quality differs for each task. Routing also helps enterprises cut their token bills.
“We’ve had this era of token maxing, where a lot of enterprises go out there and say, ‘Okay, everyone, go wild, spend your tokens.’ What follows from that is they’re like, ‘Oh, now we’re spending a lot of money on tokens, so let’s figure out how we can do this efficiently,’” he said.
OpenAI, Anthropic and Google now all offer AI tools that can generate apps for companies and everyday users.
Hedin said Lovable has always had rivals, including startups that launched before it, and has focused on execution rather than on building a moat.
Lovable has followed its users into supporting an app’s full life cycle, from building it to hosting it and growing a business on it, with services that AI agents can work with for search engine optimization (SEO), email campaigns, payments and databases.
“If you ask me about the labs, they focus a lot on the first part, which is building your software. What comes after is something that we’ve gone really deep on,” he said.
He said running such services is hard at Lovable’s scale of more than 1 million new projects a week.
A growing share of Lovable’s revenue now comes from hosting users’ sites. Lovable runs its own website on the platform, yet it draws only about 4% of overall traffic, with users’ sites taking the other 96%. Hedin said users are increasingly moving from building apps to running and growing businesses on them.
Lovable does not track how much money its users make, as it lacks access to that data, he said.
Software built in-house
Hedin said companies are already replacing traditional software-as-a-service (SaaS) with apps built on Lovable, and he expects the trend to grow in the long term. He said this is happening across customer segments.
He cited Rafael, a founder in Brazil whose AI education company has about 50 employees. Every member of staff builds the tools they need on Lovable, so the company does not use SaaS in the traditional sense. Hedin said larger businesses start with software that needs heavy customization.
“If you have an industry-specific CRM (customer relationship management system), then in a lot of cases it might be easier to build something that is fully customized to you as a company, not to you as an industry,” he said.
Two-thirds of Fortune 500 companies use Lovable, mostly after staff finds it through word of mouth rather than top-down programs.
“The usual way that staff would be able to get the software that they need is to wait for engineering to serve them, which either takes a long time or doesn’t happen at all because it’s hard for them to prioritize all of these needs,” Hedin said.
He said about 80% of Lovable’s users come to build a business or to work within an existing one.
Lovable’s users range from solo founders to small and mid-sized firms and large enterprises. Hedin said solo founders are a new market of people who once lacked the resources to build what they can today.
He and co-founder Anton Osika, now Lovable’s chief executive, worked together at a Y Combinator-backed startup in Stockholm. Osika later released GPT Engineer, an open-source project from 2023 that was among the first to show AI could build software from start to finish. Most AI coding tools then targeted developers.
“We thought, let’s make something for the 99%, for most of the people in the world that have not spent years learning how to code,” Hedin said.
He said one of Lovable’s biggest challenges is the blank canvas problem (or blank page syndrome), when new users face an empty prompt box and wonder what to do with it. People already use Lovable for personal software, family apps, new companies and existing businesses.
“This kind of visceral feeling that you can only get by using AI to create is irreplaceable. So I would just say go and try different things and look at what other people are doing,” he said.
Hedin said he hopes no single lab wins the race to artificial general intelligence. Lovable now does some of its own work on the model layer but relies heavily on partners, so he said keeping at least two or three model makers in the market is very important.