CodeRabbit $1.5B Valuation Meets a 59% Vulnerability Catch Rate

The round

CodeRabbit, the San Francisco startup that uses AI to review pull requests automatically, announced a $143 million Series C on August 12, 2026, at a $1.5 billion valuation 34. Atomico and Smash Capital co-led the round. New backers include BMW i Ventures, Datadog, Hirtle Callaghan, SineWave Ventures and Scenic Management. Returning investors include CRV, Scale Venture Partners, Flex Capital, Pelion Venture Partners, Harmony Partners and Engineering Capital 4. Alongside the raise, the company introduced a product it calls Agentic Change Management. Atomico describes it as a "control layer" that helps teams govern software changes as AI agents take on more of the development work 4.

The raise comes less than a year after a $60 million Series B 3. Tracking data puts the earlier valuation at $550 million, which means the price has grown about 2.7x across three priced rounds since January 2025 2.

The numbers behind the price

The revenue picture depends on which figures you use. CodeRabbit disclosed $15 million in revenue with its September 2025 round, which implied a multiple of roughly 36.7x at the time 2. More recent estimates are much higher. Sacra reportedly pegged annual recurring revenue at about $40 million in April 2026, up roughly 700% from $5 million a year earlier. Coverage of the round describes revenue as growing more than fivefold year over year 3.

On that $40 million estimate, the new valuation works out to about 37x revenue, a multiple that has been called aggressive even by the standards of current AI software 3. The multiple is roughly the same as the one investors paid at the Series B on much lower revenue 23. In other words, investors appear to be pricing in continued hypergrowth rather than paying for results already achieved.

The benchmark problem

The funding lands against a less flattering data point. A comparison of seven AI code review tools ran each one against the OpenSSF CVE Benchmark, a public set of more than 200 real-world production vulnerabilities across several languages and vulnerability classes. CodeRabbit caught 59.39% of the vulnerabilities and posted an F1 score of 36.19% 1. The evaluators read that as missing about 41% of real flaws. They also said the low F1 score points to a meaningful false-positive problem on top of the misses 1.

The same analysis argues that CodeRabbit's pure-LLM design, with no deterministic static-analysis baseline underneath, makes its results non-deterministic. It also notes that accuracy across the category ranged from 6% to 82% 1.

That context matters. The comparison was published by DeepSource, which sells its own code review product, and it was last updated in March 2026, months before the round closed 1. The benchmark itself is public. Readers should still treat a vendor-run comparison as one input rather than a final verdict.

Other evaluators came out differently. Monterail ran its own assessment of AI code review tools and named CodeRabbit its top pick over GitHub Copilot and Cursor's BugBot. Even so, it chose a staged rollout rather than an organization-wide switch 5.

Why the market is paying up anyway

The bull case rests on volume. Assistants like Copilot and Cursor have sharply increased how much code lands in each pull request. Monterail argues that expecting human reviewers to catch every subtle bug in large AI-assisted changes is becoming unrealistic 5. CodeRabbit's backers frame the round the same way, as a bet on the surge in AI-generated code 3.

Competition is moving fast too. Cursor said on June 8, 2026, that BugBot would switch from per-seat to usage-based billing, at roughly $1.00 to $1.50 per review depending on pull-request size and complexity. BugBot currently supports GitHub only 5. Pricing and platform reach are becoming points of competition alongside raw detection quality.

The takeaway

The two stories fit together more than they conflict. Investors are not paying for a security scanner that catches every CVE. They are paying for a workflow layer that sits in the pull request, where AI-generated code now piles up. The Agentic Change Management launch suggests CodeRabbit sees its value in governing change, not only in finding flaws 4.

The benchmark still makes a useful point. Teams that rely on an LLM reviewer as their main security gate may be accepting more misses and more noise than they realize 1. A reasonable approach is to treat CodeRabbit-style tools as a productivity layer and keep deterministic analysis in place for security-critical paths. Whether a 37x multiple holds up will depend less on any single benchmark and more on whether revenue keeps growing fivefold a year 3.