The Guy Who Vibecoded a $1.8 Billion GLP-1 Company Got an FDA Warning First

The New York Times published a profile on April 2 about Matthew Gallagher, a 41-year-old in Los Angeles who used AI coding tools to build a GLP-1 telehealth company called Medvi. The numbers were staggering: $401 million in revenue in 2025, roughly $3 million per day, with just two employees (Gallagher and his brother Elliot). He started with $20,000 in September 2024 and projected $1.8 billion in revenue for 2026.

The story landed as apparent proof of Sam Altman’s prediction that AI would produce a one-person billion-dollar company. Altman reportedly expressed interest in meeting Gallagher. The Medvi story trended on X and ran across dozens of outlets framing it as the future of AI-powered business.

Then people started looking closer.

How He Built It

Gallagher did not write code himself. He used ChatGPT, Claude, and Grok to generate the platform code. Midjourney and Runway produced the advertising images and video. ElevenLabs handled AI voice for customer service. Custom bots connected the systems together. The whole thing took about two months to build.

The actual medical side of the business is entirely outsourced. Medvi is a marketing and sales front-end. Licensed physicians, prescriptions, pharmacy compounding, fulfillment, shipping, and compliance all run through third-party platforms CareValidate and OpenLoop Health. Gallagher owns the brand, the website, the ads, the checkout flow, and the customer service layer.

This is the part that makes the “vibe-coded company” framing both accurate and misleading. The code was AI-generated, yes. But the business is fundamentally an AI-powered marketing operation for outsourced drug sales, not a technology company in any traditional sense.

The Part the Times Left Out

Before the NYT profile ran, Medvi had already received FDA Warning Letter #721455 on February 20, 2026. The letter cited misbranding, false claims of being a drug compounder, and unauthorized language implying FDA approval. It warned of potential seizure or injunction.

The Times piece didn’t mention the FDA warning. It also didn’t mention the class-action lawsuit filed in November 2025 against OpenLoop (Medvi’s clinical partner) and pharmacy partner Triad Rx, which included RICO and consumer protection claims. Or the 1.6-million-record data breach at OpenLoop in January 2026 that exposed patient names, addresses, dates of birth, and medical histories.

After backlash, the Times appended an editor’s note: “Our piece should have included that information to give readers a fuller picture.”

The Fake Doctors

This is where the story goes from “aggressive startup cuts corners” to something harder to wave away.

Drug Discovery & Development found over 5,000 active Medvi-related ads on Meta running under fabricated physician identities. More than 800 fake doctor accounts on Facebook promoted the company under fictitious names. Some of these names were plainly absurd: “Professor Albust Dongledore,” “Dr. Richard Horzgock.” One profile, “Dr. Robert Whitworth,” listed a practice at 2015 Nutter Street, Cameron, MT 64429, an address that doesn’t exist.

Real physicians whose names or likenesses appeared in these ads told Futurism they had no affiliation with Medvi and demanded removal.

Gallagher blamed the fake doctor ads on “poorly-policed affiliates” and “uncouth affiliate marketers.” On April 10, Medvi removed both listed physicians from its website after being contacted by reporters.

The Deepfake Before-and-Afters

Futurism’s investigation found that Medvi’s customer transformation photos were fabricated:

“Michael P.” was actually a Reddit user’s 2017 sobriety recovery photos, posted years before GLP-1 drugs were widely available, with an AI-altered face
“Sandra K.” was stolen from a 2021 Newsweek weight loss article
“Melissa C.” photos had been circulating online for nearly a decade
“Helen K.” was entirely AI-generated, with visible fingernail artifacts

Medvi later added a disclaimer that individuals shown “may be actors or AI-generated portrayals.”

The Drug Efficacy Question

The November 2025 lawsuit raised a separate concern that goes beyond marketing. The complaint alleged that compounded oral tirzepatide tablets, one of the products sold through Medvi’s platform, have “no viable absorption pathway” and called them “modern-day snake oil.” Eli Lilly, which makes branded tirzepatide (Mounjaro/Zepbound), confirmed no human studies exist for oral tirzepatide.

This matters because compounded semaglutide and tirzepatide exist in a regulatory gray zone. The FDA had declared the shortages of both drugs resolved (tirzepatide in December 2024, semaglutide in February 2025), which normally triggers restrictions on compounded versions. Companies like Medvi have continued selling them through legal and regulatory challenges to those shortage determinations.

What $1.8 Billion Actually Means Here

A point that got muddled in the coverage: $1.8 billion is Gallagher’s own revenue projection for 2026. It’s not a company valuation. Medvi has not raised outside funding. The verified 2025 number, reported by the NYT after reviewing financials, is $401 million in revenue with a 16.2% net profit margin (roughly $65 million in profit) from 250,000 customers.

For context, Hims & Hers generated $2.4 billion in revenue with 2,442 employees and a 5.5% profit margin. Medvi claims nearly triple the margin with two employees.

The Forrester analysis of the story was blunt about the distinction: Gallagher didn’t build a billion-dollar company. He built an AI-automated marketing funnel on top of other companies’ regulated infrastructure, and the revenue numbers, while real, reflect sales volume through that funnel rather than the kind of enterprise value the “billion-dollar company” framing implies.

The Vibe Coding Angle

Strip away the fraud allegations and the FDA warning for a moment, and there’s still something real in this story about what AI tools can do.

Gallagher took $20,000, a handful of AI tools, and two months, and built a direct-to-consumer operation that generated $401 million in its first full year. The code was AI-generated. The ads were AI-generated. The customer service was AI-generated. Even the fake doctor profiles and deepfake photos, the things that are now sinking the company’s reputation, were produced with AI tools.

That’s the uncomfortable part of the Medvi story. The AI tools worked exactly as advertised. They let one person do the work of hundreds. They just didn’t have opinions about what that work should be.

Gallagher’s previous company, Watch Gang (a watch subscription box launched in 2016), had 60 employees and never turned a profit. He took from that experience the lesson that more people meant higher costs and slower decisions. AI let him test that hypothesis at a scale nobody expected.

The problem isn’t that AI tools can build a company this fast. The problem is that speed and scale don’t come with guardrails. The same tools that wrote the code and generated the ads also produced deepfake patient testimonials and thousands of fake physician identities. Building fast and building responsibly turned out to be separate skills, and Gallagher appears to have optimized heavily for the first one.

Where It Stands Now

As of mid-April 2026, Medvi faces:

An FDA warning letter threatening seizure or injunction
A class-action lawsuit (November 2025) with RICO claims against its clinical partner
A spam class-action (March 2026) filed in California
Documented use of deepfake testimonials and fabricated doctor personas at scale
A 1.6-million-record patient data breach at its clinical partner

Gallagher has dismissed critics as “low t guys” and internet “Karens” in since-deleted X posts and called Medvi a “net positive for humanity.”

Techdirt’s headline captured the mood of the subsequent coverage: “The New York Times Got Played By A Telehealth Scam And Called It The Future Of AI.”

Whether Medvi survives the regulatory and legal pressure is an open question. What isn’t open is that the story has already become the go-to cautionary tale for vibe coding at scale: proof that AI tools are powerful enough to build a $400-million-a-year business in months, and that power without oversight can go sideways just as fast.