CodeRabbit secures $143 million for AI governance push

CodeRabbit has raised $143 million in Series C funding at a $1.5 billion valuation, giving the AI code-review company fresh capital to expand into software governance, security and international markets.

The San Francisco-headquartered company is broadening its focus beyond reviewing individual code changes as businesses confront a sharp increase in software produced by artificial intelligence agents. Its newly introduced Agentic Change Management platform is designed to help engineering teams decide which changes require attention, assess their wider architectural impact and monitor deployed software for vulnerabilities.

Atomico and Smash Capital co-led the funding round. New investors included BMW i Ventures, Datadog, Hirtle Callaghan, SineWave Ventures and Scenic Management, while existing backers including CRV, Scale Venture Partners, Flex Capital, Pelion Venture Partners, Harmony Partners and Engineering Capital also participated.

The investment represents a substantial valuation increase for the company. CodeRabbit raised $60 million in a Series B round in September 2025 at a valuation of about $550 million. That round took its funding at the time to $88 million. The latest financing comes after revenue increased more than fivefold year on year.

CodeRabbit now carries out more than two million code reviews every week and serves more than 17,000 customers. Users include Nvidia, BMW, JFrog, Trivago, Adyen and Indeed. More than 150,000 open-source projects also use its technology.

The rapid expansion of AI coding assistants has created an opportunity for companies providing independent verification of machine-generated software. Developers can now produce code and open pull requests much faster, but organisations still need to determine whether those changes are reliable, secure and consistent with the architecture of existing systems.

CodeRabbit is attempting to position itself as an independent control layer between code generation and deployment. The company argues that software created by developers and AI agents requires validation that does not depend on the same models responsible for generating the code.

Its expanded platform includes CodeRabbit Triage, which assesses incoming pull requests using factors such as urgency, risk, dependencies and readiness. Higher-risk changes can be directed to human reviewers, while lower-risk work can move through automated processes. Duplicate or insufficiently prepared changes can also be filtered before consuming engineering resources.

Another product, Change Stack, analyses how a proposed modification interacts with the wider software system. Instead of presenting reviewers only with a list of altered files, it identifies effects on areas including application behaviour, integrations, tests and migrations. Architecture and so-called blast-radius analysis are intended to show where a change could have wider consequences.

CodeRabbit Security extends the platform beyond the point at which software is merged. It scans repositories and monitors production code for vulnerabilities and maintainability problems. Potential fixes can then be routed back through the pull-request process for examination before deployment.

Security is becoming an increasingly important part of AI-assisted development. More capable large language models can help programmers discover vulnerabilities, but the same technology can also reduce the technical expertise and time required by attackers to identify weaknesses across large codebases.

The company plans to use part of its new capital for research and product development as well as geographical expansion. It has opened an office in London’s Moorgate district and has built a workforce of about 50 employees across London and the European Union. Further European hiring is planned, alongside entry into Japan and other Asian markets.

CodeRabbit will also invest more than $10 million over the next 12 months to keep AI code-review and agent capabilities available free of charge to open-source projects and maintainers.

The growth of automated review does not eliminate questions about reliability. A July study examining more than 31,000 pairs of CodeRabbit reviews and developer responses across 239 GitHub repositories found that 36.4 per cent of automated review comments were accepted and another 7.3 per cent generated discussion. About 56.3 per cent were rejected, often because developers considered suggestions invalid, redundant, outside the relevant scope or inconsistent with their intentions.