No-Code Didn't Die. It Sold for 2.7x ARR While Its Replacement Raised at 27x

On 4 September, Airtable's newsroom announced it had "become part of Bending Spoons". The reported terms, which I can only source to SaaStr and not to either company, were an enterprise value of about $1.285 billion for a business doing roughly $480 million in annual recurring revenue and growing over 20%. That is 2.7 times revenue, for a company valued at $11.7 billion in 2021, that had spent the previous fifteen months relaunching itself as an "AI-native app platform".

Three weeks earlier Lovable, a company that did not exist when Airtable last raised, confirmed a $13.3 billion valuation on $500 million of ARR. Same order of revenue, ten times the multiple, and the disclosure that the investor who led the round also owns the publication that reported it, which I mention because it is the kind of thing that ought to be mentioned.

I have spent this year building Riff, a self-hosted alternative to exactly the tools that got the 27x, so I am not a neutral observer of this market and you should read what follows accordingly. But I have also spent fourteen years watching "citizen developer" platforms get sold to enterprises, and I think the 2026 numbers tell a more specific story than "no-code is dead". They tell you what no-code was actually selling, who has taken that business, and what the buyers have not yet noticed they are missing.

The numbers, in one chart

The rest of the table, for the record. Replit raised $400 million at $9 billion in March and is targeting $1 billion ARR by year end. Base44, which Wix bought for $80 million plus earn-outs in June 2025, was at about $150 million ARR by May and now runs on a Wix-trained model to get gross margins toward 60%. Emergent, out of Bengaluru, went from a $300 million valuation in January to a reported $1.5 billion in July on $100 million of ARR. Vercel's CEO signalled IPO readiness in April and said 30% of apps deployed on the platform are now deployed by agents rather than people.

On the other side of the ledger: Webflow cut roughly 8% of staff in May while restructuring around an "agentic web" strategy, though I only have that from secondary reporting. Zapier's last hard revenue figure is $310 million from 2023; its 2026 story, told through Madrona, is that it has more internal AI agents than employees. Bubble reports 6 million builders and is rolling an AI agent into every existing app, with no layoffs that I could find. Retool is estimated around $120 million ARR and sells agents by the hour. Pipedream was bought by Workday. Manus's $2 billion sale to Meta was blocked by Beijing and is unwinding.

And Flowise, the open-source visual agent builder with 55,000 GitHub stars, archived itself on 13 August. The maintainer's explanation was that low-code "quickly hits the limit when it comes to complexity" as coding agents improve. That is the most honest sentence anyone in this category wrote this year, and it came from inside.

What no-code was actually selling

Here is my reading of why the multiples diverged, and it is not that one set of products works and the other does not.

Visual builders sold three things bundled together: a way to express logic without code, a managed backend (database, auth, hosting, integrations) so the builder never had to think about infrastructure, and a distribution channel into business teams that did not have engineers. The first was the marketing. The second and third were the business.

Prompt-to-app tools took the first thing away entirely. Nobody who can describe an app in English wants to drag a "when button clicked" block onto a canvas, and the METR and Stack Overflow data I will get to below suggest that even professional developers' relationship with AI tools is more ambivalent than the vendors claim; for non-developers there is no ambivalence, because the alternative was a canvas. The visual layer was the least defensible part of the product and it is the part the market has re-priced.

What the new tools did not take away is the managed backend, and this is where the interesting engineering is. Look at how each of them hosts what it generates:

Builder	Where the generated app runs	Where the data lives	Code export
Lovable	Lovable-hosted URL	Supabase, provisioned per project	Full repo synced to GitHub or GitLab
Bolt.new	In-browser WebContainers during build, Netlify on publish	Supabase	Yes
Replit	Single-tenant GCP project per customer, Replit's own VMs	Replit's Postgres	Yes
v0	Vercel, with agents in Vercel Sandbox microVMs	Whatever the app connects to	PR-based
Base44	Wix's own stack; backend, auth and hosting "built in"	Wix	Limited
Codex Sites (OpenAI, Jun 2026)	OpenAI-hosted *.openai.chatgpt.site	Cloudflare D1 (10 GB) and R2	Limited; PHI and card data prohibited
Riff	Your infrastructure, one Firecracker microVM per app	Per-project Postgres in the VM	It is your repo from the start

Every one of these is, underneath, a no-code platform's managed backend with a chat box in front of it instead of a canvas. The moat did not move; the interface did. And the backend is where every documented failure has happened, which is the part of the story I think the buyers of 27x have not fully priced.

Where the generated apps break

I catalogued the incidents in Saturday's post on SaaS repricing, so I will not re-narrate them. The list, with primary sources: Lovable's CVE-2025-48757, 170-plus apps with Supabase row-level security missing; Wiz's Base44 finding, unauthenticated registration endpoints on private SSO-gated apps; Wiz's Moltbook finding in February, a hard-coded Supabase key and no RLS exposing 1.5 million agent tokens, built by a founder who said he "didn't write a single line of code"; and Lovable's own ten-week regression from February to April where any logged-in user could read other users' project source and chat history.

Four incidents, one root cause: authorisation on the data layer. Not the UI the model wrote, not the business logic; the row-level security policy, the Firebase rule, the endpoint that checked authentication but not ownership. That is a category that classic no-code platforms had solved, badly and expensively, by owning the data model. Airtable never let you forget to write a permission rule because Airtable wrote it. Lovable hands you a Supabase project and a model that, in 2025, checked whether a policy existed rather than whether it was correct.

This is not a reason to prefer the old tools. It is the specification for what the new ones have to build, and the vendors know it; Lovable's scanner has improved, Replit added separate dev and production databases after deleting SaaStr's production data, and Wix trained its own model partly so it could control what Base44 generates. When I built Riff I made a different trade: each app is a real microVM with its own Postgres, forkable with the running state, on infrastructure the user controls, so the blast radius of a bad policy is one tenant's own database rather than a shared Supabase project with a public anon key. That does not stop the model from writing a bad policy. It does stop the bad policy from being the same one across five thousand apps, which is what the May scan that found more than 5,000 unauthenticated generated apps was really measuring.

What the outcome data says

The productivity and retention evidence is thinner than either side's marketing, and it is worth being precise about it.

• METR's updated randomised trial (24 February 2026) found the original 2025 cohort of experienced open-source developers still 18% slower with AI tools (confidence interval from −38% to +9%), and a new cohort at −4% (−15% to +9%). The more important finding is methodological: 30 to 50% of invited developers refused tasks without AI, so METR is abandoning task-level randomisation. The population that can be studied without AI is disappearing.
• Stack Overflow's 2025 survey (33,662 respondents on the AI questions) had 84% using or planning to use AI tools, 3.1% trusting them highly, 45.7% distrusting them, and 72% saying they were not vibe coding. The 2026 survey opened in June and the results are not out; the "2026" numbers circulating on aggregator sites are the 2025 figures relabelled.
• RevenueCat's 2026 benchmarks across 115,000 subscription apps found AI apps' twelve-month payer retention 36% worse than non-AI apps, at 9.2% on iOS, but with 41% higher first-year lifetime value. Fast money, faster churn.
• The widely repeated claim that "60% of vibe-coded projects are abandoned" has no primary source that I or the research I commissioned could find. The pages cited for it do not contain the number. Do not use it.

What the enterprise side says is louder and less falsifiable. Microsoft told analysts in April that nearly 90% of the Fortune 500 have active agents built with its low-code tools, and reported 30 million paid Microsoft 365 Copilot seats in July. Salesforce reported Agentforce ARR above $1.5 billion in August, up 240%, after redefining the metric to include Slackbot and its headless data platform. Forrester renamed the whole category "AppGen and low-code" in its Q2 2026 landscape and counted 40 vendors. The Gartner Magic Quadrant, which I could only read via a reseller's summary, still has Mendix, Microsoft and OutSystems as leaders, none of which appear in the funding rounds above.

So: enterprise low-code did not die either. It became the place where Copilot Studio agents get governed, and its buyers are procurement departments that value the governance more than the canvas. The two markets that used to be one, business-team app building and enterprise process automation, have split, with the first going to prompt-to-app tools priced like consumer growth companies and the second staying with the incumbents priced like software.

The open-source layer underneath

The open-source numbers, from the GitHub API on 7 September, are their own story:

Repo	Stars	Licence
n8n	203,586	Sustainable Use (not OSI open source)
Dify	154,674	Apache-2.0 derived, with restrictions
Langflow	154,359	MIT (owned by IBM via DataStax)
NocoDB	64,865	custom
Flowise	55,428	Apache-2.0, archived
ToolJet	40,858	AGPL-3.0
Appsmith	40,827	Apache-2.0
Budibase	28,260	GPL / commercial
Activepieces	24,302	MIT core
Riff	3	MIT, nine days old

n8n is the largest project in the category by a wide margin, is not open source under the OSI definition, and was reportedly valued at $5.2 billion by SAP in May; I could not find a primary announcement of that round. The two largest permissively licensed projects belong to a Chinese startup and to IBM. The clearest lesson in that table is Flowise: visual agent builders were the first thing coding agents made obsolete, because an agent is easier to describe in a paragraph than to draw. Automation graphs with hundreds of integrations, which is what n8n and Zapier sell, are harder to replace because the value is in the connectors, not the canvas, and connectors are exactly the thing MCP is now commoditising. I would not bet on the canvas outlasting the decade in either product; I would bet on the integration catalogue and the audit log.

What I would tell a team choosing

If you are a business team with no engineers and a workflow to automate, the honest answer in 2026 is the same as in 2022: Zapier, Make or n8n, with the difference that you should now write the workflow in prose and let the tool draw it. Those products' AI features are real and the connectors are the moat.

If you are building an application, the calculus has changed. A prompt-to-app tool will get you a working prototype in an afternoon that a Bubble build would have taken a week. Then, before a single real user's data goes in, do the thing the model does not: read the RLS policies, run a scanner that tests whether row A is readable by user B, move the anon key out of the client bundle, and split dev from production. Every incident above was a missing afternoon of that. If your data is regulated or you need to own the runtime, the self-hosted layer exists: Riff for the app builder, Appsmith or ToolJet for internal tools, Activepieces or n8n for automation, and you will spend on operations what you saved on the subscription.

If you are an investor, I have nothing useful to say except that Airtable at 2.7x and Lovable at 27x cannot both be right about the value of a managed backend with a friendly interface, and the incidents suggest the market has priced the interface and not the backend. The backend is where the work is. It always was.

---

Related: Seats Are Dying: The 2026 SaaS Repricing and AI Agent Sandboxes: What They Are and How to Choose One. Disclosure: I build Riff, which appears above.