The NYT Just Got Played. Here's the Part They Missed.

THE CRAFT

Last week the New York Times published what looked like the perfect story for 2026: two brothers, $20,000 in starting capital, $401 million in first-year revenue, and almost no employees. They’d built the company with AI doing the engineering, the marketing, and the operations. Sam Altman had been calling this moment for two years — the one-person billion-dollar company — and here it was, profiled in America’s paper of record, right on schedule.

Within twenty-four hours the story started coming apart. Within a week, multiple outlets were calling it a scam. I watched it happen in real time on my feed, and I want to walk you through what I saw, because the Medvi story is not a story about AI. It’s a story about what happens when the AI hype cycle meets a press corps that doesn’t know what questions to ask. And it’s going to happen again, and again, and again, to every board member and LP and peer CEO who forwards you a “look at this amazing AI company” profile over the next twelve months.

So I’m writing this one for you — the operating leader of a real company with real employees and real customers — because you are about to be handed a lot of Medvi-shaped stories in the next year, and you need a way to read them that doesn’t leave you feeling either gullible or cynical.

THE OPERATOR

The profile that launched the story

On April 2, 2026, New York Times tech reporter Erin Griffith published a profile of Medvi, a Los Angeles-based direct-to-consumer telehealth company selling compounded GLP-1 weight-loss drugs (the compounded versions of Ozempic, Wegovy, Mounjaro, and Zepbound). The headline number: $401 million in sales in 2025, Medvi’s first full year of operations. The punchline: they did it with two employees — founder Matthew Gallagher and his younger brother Elliot, who is officially the company’s only hire. Medvi is generating roughly $3 million a day. Griffith reported that the company is tracking toward $1.8 billion in 2026 revenue.

For context, the public telehealth company this most directly compares to is Hims & Hers, which did $2.4 billion in 2025 with 2,442 employees and a net margin of 5.5%. Medvi posted a net margin of 16.2% — about three times Hims & Hers — with roughly one one-thousandth the headcount. The piece framed this as proof-of-concept for something Sam Altman had been saying since early 2024: AI would enable a single founder to build a billion-dollar company.

Within the tech community, the story hit exactly the nerve it was designed to hit. This was the future, finally made legible. It was the thing everyone had been waiting for. It was the story a lot of people wanted to be true.

What the profile left out

The FDA had sent Medvi a warning letter on February 20, 2026 — six weeks before the NYT profile ran. Warning letter #721455. The FDA found that Medvi’s website language falsely implied the company was the compounder of the semaglutide and tirzepatide products it sold. It found that marketing claims like “same active ingredient as Wegovy” and “same active ingredient as Mounjaro” falsely implied FDA approval or evaluation of the compounded versions. This was a misbranding action — about how Medvi was representing the products, not the chemistry of the products themselves — but it was a formal enforcement letter from the federal regulator with direct authority over the entire business model.

The NYT profile did not mention the warning letter.

What happened within twenty-four hours

The morning after the profile published, a journalist ran a search of Meta’s public ad library for “medvi.” The library returned more than 5,000 active advertisements. By the following day, reporters and industry watchers had started documenting a pattern: a significant portion of those ads featured photos and names of doctors endorsing Medvi — and many of the “doctors” appeared to be fabricated. One investigation later estimated more than 800 Facebook accounts tied to apparent fictitious medical personas. After Business Insider published its own investigation, Medvi’s Meta ad count dropped from 5,000 to 2,800 over the course of a few days.

Then the lawsuits surfaced. James v. Medvi LLC, filed in the Central District of California in March 2026, was already in the docket. A separate class action had been filed on March 20, 2026, alleging that Medvi was benefiting from an affiliate-spam email operation — subject lines like “This might be the easiest way to start Ozempic” routing consumers to Medvi landing pages. The complaint estimated at least 100,000 consumers affected.

Then the industry context came into focus: in March 2026, the FDA had issued warning letters to more than 30 telehealth companies for similar compounded-GLP-1 marketing violations. Medvi wasn’t a one-off. It was part of a regulatory sweep of an entire gray-market category — compounded versions of drugs that were only legal to compound during a formal FDA shortage of the branded versions, and the shortage had ended.

By April 7, five days after the profile ran, Techdirt had published an article with the headline “The New York Times Got Played By A Telehealth Scam And Called It The Future Of AI.” Other outlets followed. The AOL syndication of the Business Insider piece led with “Medvi, the AI-powered telehealth company, is fueled by ads from doctors who don’t appear to exist.”

Matthew Gallagher has denied the scam framing. Medvi has publicly responded to the allegations about fabricated doctors. The company has not, at the time of this writing, been shut down. It is still generating revenue. But the one-person-billion-dollar-company narrative — the thing the NYT profile existed to celebrate — is effectively dead in sophisticated circles, and the story is now about something else.

The Craft of AI read

Here’s what I want you to take from this, and it’s not the thing everyone else is going to write.

The Medvi story is not about AI. I mean that literally. Every single component of what Medvi allegedly did — the compounded-GLP-1 arbitrage, the fabricated-endorser advertising, the affiliate-spam funnel, the misbranding that drew the FDA warning — is a classic direct-to-consumer pharmacy playbook that existed long before large language models. You could have run this business in 2018. AI didn’t enable the model. AI might have made the unit economics slightly better by replacing a few dozen headcount with tooling, but the business structurally works whether the back office is humans, scripts, or LLMs. The “two-person” framing in the profile was the narrative hook, not the operational insight.

What AI actually did was make it legible to a reporter. The NYT profile exists because Erin Griffith needed a story that fit the cultural moment, and “two brothers, AI-powered, $401 million in a year” fit the cultural moment. The reporting asymmetry is the real story here: when a company hands a journalist a narrative that matches the prevailing thesis of the tech press, the journalist has to work three times as hard to verify it, because everyone reading the story — the editor, the copy desk, the audience — wants it to be true. Skepticism feels like pedantry. That’s the mechanism. And it’s going to produce three or four more Medvi-shaped stories this year, because the incentives haven’t changed.

Here’s the actually interesting thing about AI in this business model: Medvi allegedly built an advertising operation that could run more than 5,000 simultaneous Facebook ads with fabricated medical endorsers. If that’s true, the part that’s new and worth thinking about is not “AI built a billion-dollar company” but “AI made it cost-effective to fabricate regulated endorsement content at a scale that one compliance person couldn’t possibly monitor.” That is a real thing that is now possible, and it is a real problem for every regulated industry — including healthcare, financial services, legal, and insurance. The lesson for your company isn’t “we should be like Medvi.” The lesson is “we need to think about what happens when a competitor, or a bad-faith actor in our category, uses AI to fabricate content at scale, and what our regulatory and reputational exposure looks like when they do.”

The last thing, and the one I keep coming back to: the Medvi story is going to be used as a cudgel by two different groups of people in the next six months, and both of them are wrong.

The first group is the AI skeptics who are going to say “see, the whole AI-productivity story is a fraud, it’s just better marketing for scams.” That’s wrong. The AI-productivity story has plenty of real examples. Medvi isn’t evidence against it; Medvi is evidence that narrative-fit gets ahead of due diligence. Those are separate problems.

The second group is the AI enthusiasts who are going to say “Medvi was a bad actor, but the real one-person billion-dollar company is still coming, and the next one will be legitimate.” That’s also wrong, or at least wrongly framed. The reason “one person, billion dollars” is almost always going to land on sketchy businesses is that legitimate businesses at scale are bottlenecked by trust, relationships, regulation, and the slow work of building institutional credibility — none of which AI short-circuits. The businesses AI can run with minimal headcount are the ones where trust, relationships, regulation, and institutional credibility are optional — which is another way of saying they’re the businesses where the customer loses.

This doesn’t mean AI can’t remove real headcount from real companies. It absolutely can, and it is. But the ceiling on “how few people can run a serious business” is set by the trust infrastructure the business depends on, not the tooling the business uses. If your business is in a category where your customers trust you to be accountable, that accountability is done by humans, and it will still be done by humans in 2030, even if the back office is running on agents.

Things to consider

1. Who in your organization would have read the NYT profile and forwarded it to you? Not to criticize them — to understand how they filter AI signal. If they didn’t notice the FDA warning letter, neither will they notice similar gaps in the next profile.
2. What’s your own category’s Medvi going to look like? Every regulated industry has a gray-market adjacent version where AI can produce fabricated content at scale. In yours, what is it? Who is the most aggressive competitor, and what regulatory corner are they cutting?
3. If you spent 4 hours this week mapping where your own AI-adjacent content can be fabricated — customer reviews, case studies, endorsements, testimonials, partner quotes — what would you find? Not in your company. In your category. Because that’s the distortion field your buyers are now operating inside.
4. Which of your “two employees with AI” aspirational benchmarks would change if you added a line that said “and a regulatory exposure their executive team cannot personally verify”? Most of them, probably. That’s worth saying out loud in your next ops meeting.
5. Who on your team is responsible for spotting Medvi-shaped stories in your own AI pilots? If the answer is “nobody” or “our AI consultant,” you’re in the same position the NYT was in when Griffith wrote that profile.

THE WORKBENCH

Here’s the tactical takeaway for your Monday.

Build a “pre-mortem filter” for every AI hype piece your team forwards. Three questions. Five minutes. Do it out loud in a meeting.

1. Who is the regulator here? Every business has one — FDA, FTC, SEC, DOJ, state AG, industry body. Has the regulator taken any public action against this company in the last twelve months? If the answer is “I don’t know,” that’s the answer: nobody verified this before forwarding it.
2. What’s the lawsuit count? Pull PACER, pull state court records, pull the big class-action trackers. A company at $400M in revenue with zero active lawsuits is either three weeks old or pre-litigation. Medvi had at least two active cases before the NYT profile ran.
3. What does the ad library say? Every major ad platform has a public ad library. Meta, Google, TikTok, LinkedIn. Pull the company’s active ad count and spot-check the creative. If you see endorsers you can’t verify against LinkedIn or state medical boards, you are looking at the fabrication problem up close.

Run this filter on the last three AI hype pieces your board forwarded you. I’ll bet at least one of them fails at least one check. That doesn’t mean the company is a fraud. It means the story was written before due diligence was done, and you now know which stories your filter has to catch before they influence your strategy.

THE QUESTION

I’m collecting honest answers for the next issue, and I’d like yours.

When you read the NYT profile of Medvi last week — assuming you saw it — what was your first instinct? Was it “we’re doing it wrong, we should be thinking about AI more aggressively”? Was it “this can’t be real”? Was it “I wish my board would let me move this fast”? Was it something else entirely?

Hit reply, or send a note to grant@thecraftofai.com and tell me. No fancy framing, no right answer. I’m trying to figure out how the people I respect are actually processing these stories in real time, and the only way to do that is to ask.

I read every reply.

— Grant grant@thecraftofai.com