CodeRabbit Funding: $143M Bet as AI Code Vulnerabilities Climb

A big round for a growing problem

CodeRabbit, the AI code review startup based in Walnut Creek, has raised $143 million in a Series C round at a $1.5 billion valuation 25. Atomico and Smash Capital co-led the August 2026 round. BMW i Ventures, Datadog, Hirtle Callaghan, SineWave Ventures and Scenic Management joined as new investors, and existing backers including CRV, Scale Venture Partners and Flex Capital also participated 2. Atomico partner Luca Eisenstecken is joining the board 2.

The round came less than a year after a $60 million Series B 2. CodeRabbit disclosed about $15 million in revenue around that September 2025 raise 1. One funding tracker puts its valuation growth at 2.7x across three priced rounds, from $550 million at its Series A to $1.5 billion now 1. The company summed up its pitch on X: "Code is abundant. Judgment is scarce." 2

That line describes the market well. AI coding agents have made writing software cheap and fast, and human reviewers can no longer keep up with the volume 2. Investors are betting that an automated review layer becomes required infrastructure. CodeRabbit sits next to agent builders like Factory and framework providers like LangChain among the AI startups drawing growth-stage money this cycle 5.

The problem is accelerating

The risk is real. Georgia Tech researchers have warned that vibe-coding tools such as Anthropic's Claude Code are adding new vulnerabilities to production software 4. They counted at least 35 CVE entries disclosed in March 2026 that traced directly to AI-generated code. That compares with 15 in February and six in January 4.

Three months is a short window, and attributing a CVE to AI-written code is harder than it sounds. Still, the count roughly doubled each month. That trend matters more than any single figure, and it undercuts the easy story that AI review tools are already containing what AI coding tools produce.

How well does the fix work?

The less comfortable question is how well CodeRabbit catches the issues that matter most. A benchmark comparison published by DeepSource, a direct competitor, reports that CodeRabbit scored 59.39% accuracy and a 36.19% F1 score on the OpenSSF CVE Benchmark 3. DeepSource reads this as CodeRabbit missing roughly 41% of real vulnerabilities while also producing a meaningful number of false positives 3. On the same benchmark, DeepSource reports an 84.51% F1 for its own product. It credits a hybrid design that runs a deterministic static-analysis pass with more than 5,000 rules before an AI agent reviews the pull request 3.

These numbers need careful handling. They come from a rival's marketing-oriented comparison, not an independent audit. A single benchmark built around known CVEs may also say little about everyday review quality, such as logic errors, readability, or architectural drift, which are things buyers also pay for. Even so, the argument behind DeepSource's claim deserves attention. A purely LLM-driven reviewer is probabilistic. For security work, both missed findings and noisy alerts are costly. Missed findings let vulnerabilities ship, and noisy alerts teach developers to ignore warnings 3.

Reading the moment

The sources point in two directions that are easy to blur together. The funding coverage presents CodeRabbit as the answer to an explosion of machine-written code 2. The security research shows that explosion is producing more exploitable flaws every month 4. The competitive benchmark, contested as it is, suggests pure-LLM review may not be the strongest defense against those flaws specifically 3.

My reading is that the $1.5 billion valuation rests mostly on distribution and workflow. CodeRabbit is embedded in pull-request pipelines that teams already use, and that position is valuable no matter how it scores on a CVE benchmark. Its fast run from Series B to Series C suggests investors are paying for adoption momentum in a category they consider inevitable, more than for proven security outcomes 12.

The test for the next phase is whether that position turns into measurable results. If AI-linked CVEs keep climbing while review tools spread, buyers will start asking whether review tools are reducing risk or mainly giving a sense of oversight. Some of the new capital will likely need to go toward deterministic analysis, publishing transparent benchmarks, or both. Datadog, an observability company, is among the new investors 2. That may signal interest in tying review to runtime data, though the sources do not say so.

CodeRabbit is right that judgment is scarce. The open question is whether an LLM reviewer can supply enough of it on security, where the stakes are highest and, by current counts, the problem is still getting worse 4.