Note: This is a research note supplementing the book Unscarcity, now available for purchase. These notes expand on concepts from the main text. Start here or get the book.
The Solo Unicorn: One Founder, Zero Employees, a Billion-Dollar Question
The Bay Area Bet
For two years, the same question ricocheted through Sand Hill Road pitch meetings, Y Combinator dinners, and every AI-Twitter thread worth reading: Which solo founder, armed with nothing but AI agents, would be the first to build a billion-dollar company?
The bets were on fintech. Maybe a trading bot empire. Maybe a personalized education platform. A few contrarians said gaming.
Nobody guessed telehealth.
On April 2, 2026, The New York Times profiled Medvi, a telehealth company selling compounded GLP-1 weight-loss drugs that Matthew Gallagher, 41, launched from his Los Angeles home in September 2024 with $20,000 and more than a dozen AI tools. The Times was given the books: $401 million in sales in the first full year, 250,000 customers, a 16.2% net margin, and a 2026 run rate tracking toward $1.8 billion. Two full-time employees, Gallagher and his brother Elliot. No co-founder, no seed round, no office. Sam Altman had been running a bet with founder friends since 2024 on when the first one-person billion-dollar company would show up; the Times presented Medvi as the bet paying off. Gallagher treated every business function as an AI workflow and orchestrated his way to the headline.
The achievement is real. The $1.8 billion is a sales projection, not a valuation, and a company selling compounded copies of Ozempic into a regulatory window that is closing may never see the second half of that year. Discount it by half and the structural point still holds: two people, armed with AI tools, built a business with hundreds of millions in verified revenue, in one of the most regulated consumer categories there is.
Medvi is the starting gun. What follows is the race: across every industry, in every country, for every founder who just saw the playbook and is now asking, Can I do that too?
The answer is yes. And also: it’s more complicated than you think.
What Gallagher Actually Did
The “solo unicorn” model is easy to misread, so precision matters.
Gallagher didn’t build a chatbot and call it a company. He identified every function a traditional telehealth company requires (patient intake, scheduling, billing, insurance verification, marketing, customer support, documentation, follow-up) and mapped each to an AI tool. Then he wired those tools into workflows that hand off to each other, self-correct, and operate without constant supervision.
The clinical decisions stayed human, and they stayed outside the company. Two “telehealth-in-a-box” platforms, CareValidate and OpenLoop Health, supplied the licensed clinicians, the compounding pharmacies, the shipping and the compliance paperwork. Gallagher automated the connective tissue: everything between the patient clicking “book appointment” and the doctor reviewing their chart. The company that booked $401 million did not employ a single person who could write a prescription.
The skill is orchestration. Knowing what to automate, in what sequence, with what fallbacks, monitoring which outputs. The Agentic AI article maps this precisely: four tiers of AI proficiency, and only the top tier, full agentic orchestration, produces outcomes like Medvi. Most professionals plateau at tier two, using AI as a faster search engine, and never learn to build the interconnected workflows that let one person operate at the scale of sixty.
The gap between prompting and orchestrating is where the economic divergence happens.
The $20,000 Myth
The story needs a second read.
Twenty thousand dollars covers AI tool subscriptions, cloud hosting, a domain name, and maybe a few months of living expenses. It doesn’t cover what a company operating in a regulated industry actually needs to survive contact with reality.
The criticism here isn’t aimed at Gallagher. It’s aimed at the narrative built around him.
Every regulated industry (healthcare, financial services, insurance, education, food safety, pharmaceuticals, energy) has a compliance cost floor that exists for a reason: people get hurt when companies cut corners. The $20K figure describes the cost of building the product. It doesn’t describe the cost of operating the business.
The real cost stack looks more like this:
| Item | Approximate Cost | Can AI Handle It? |
|---|---|---|
| Product development (AI tools + hosting) | $10K-$20K | Yes, this is the $20K |
| Independent security audit (SOC 2 Type II) | $50K-$150K | No |
| Regulatory compliance assessment | $15K-$50K | Partially |
| Legal entity formation + contracts | $5K-$15K | Partially |
| Privacy officer (named human, required by law) | Salary or retainer | No |
| Penetration testing | $10K-$30K/year | No |
| Professional liability insurance | $5K-$50K/year | No |
| Patent filing (if applicable) | $10K-$15K per patent | No |
| Patent defense (if challenged) | $500K-$5M per case | Absolutely not |
The gap between “$20K” and “legally operational in a regulated industry” is $100K-$300K minimum. For unregulated software businesses (a SaaS tool, a content platform, an e-commerce brand), $20K may suffice. For anything touching personal data, health records, financial transactions, or physical safety, the narrative needs an asterisk the size of a billboard.
The founders who follow Gallagher’s playbook are listening to the headline, not reading the footnotes.
The footnotes arrived within weeks, and they read like a checklist of everything the table above says AI can’t do.
Six weeks before the Times profile ran, on February 20, 2026, the FDA had sent a warning letter to “MEDVi, LLC dba MEDVi” for misbranding: the website implied the company itself compounded the semaglutide and tirzepatide it sold, and lines like “Same active ingredient as Wegovy and Ozempic” implied an FDA approval the compounded products do not have. Gallagher’s answer was that the cited domain belonged to an affiliate marketing agency and that Medvi had “never received a letter from the FDA.” The letter is addressed to MEDVi, LLC at its Delaware address and quotes Medvi-branded claims. The week the profile ran, Business Insider counted more than 5,000 active Meta ads for Medvi, many fronted by physicians who do not exist: “Dr. Matthew Anderson MD,” linked to an Angolan phone number; “Dr. Spencer Langford MD,” tied to a clothing store in the Republic of Congo; faces carrying Gemini watermarks. Gallagher said “maybe 30%” of the advertising ran through affiliates, and the count dropped to about 2,800 once reporters started asking. The site’s own fine print says it plainly: “Individuals appearing in advertisements may be actors or AI portraying doctors.” Drug Discovery & Development found that the two real physicians listed on the site belonged to a concierge practice serving Florida’s equestrian community; both were removed from the site on April 10.
Then the infrastructure layer failed. OpenLoop Health, the platform that supplies Medvi’s clinicians, disclosed a January 7 intrusion; the hacker claimed 1.6 million patient records, and OpenLoop’s own filings put the confirmed count at 716,000. A class action filed in Delaware in November 2025 against OpenLoop and the compounding pharmacy Triad Rx alleges that the oral tirzepatide tablets sold through the network have “no demonstrated mechanism of absorption or efficacy”; Medvi is not a defendant, but the plaintiff bought the pills through Medvi. And the product itself lives on borrowed time: compounded copies of a branded drug are legal only while the FDA declares a shortage, the agency ended the tirzepatide shortage in December 2024 and the semaglutide shortage in February 2025, and on April 1, 2026 it said that the “personalized” vitamin-B12 blends the industry pivoted to may still be “essentially a copy.”
None of that is an AI failure. The AI did exactly what it was asked: write the code, write the ads, answer the tickets, at a speed no team of sixty could match. Every failure sits on the human side of the table, in the rows marked “No”: a named person who reads the regulator’s mail, a compliance officer who approves the ad creative, a security audit of the partner holding the medical records. The $20,000 bought the engine. Nobody bought the brakes.
The Global Compliance Maze
Healthcare in the United States is governed by HIPAA. But the solo-unicorn model doesn’t stop at U.S. borders, and the regulatory picture is far more complex than any single framework.
Consider what a solo founder faces when scaling internationally:
Data Protection & Privacy
- EU/EEA: The GDPR requires a Data Protection Officer (DPO) for companies processing personal data at scale. Fines reach 4% of global annual turnover or EUR 20 million, whichever is higher. The DPO must be independent and can’t be the person making business decisions, a structural impossibility for a solo founder.
- Brazil: The LGPD mirrors GDPR’s requirements, including mandatory DPO appointment.
- China: The PIPL (Personal Information Protection Law) requires data localization: personal data of Chinese citizens must be stored on Chinese servers, audited by Chinese authorities. A solo founder in San Francisco can’t comply without local infrastructure and personnel.
- India: The DPDP Act (2023) imposes consent management requirements and data fiduciary obligations with penalties up to INR 250 crore (~$30M).
Financial Services
- EU: PSD2 (Payment Services Directive) requires licensed payment institutions with minimum capital requirements, compliance officers, and regular audits.
- US: State-by-state money transmitter licenses: 48 separate applications, each requiring a compliance officer, surety bonds ($25K-$500K per state), and ongoing reporting.
- Singapore: MAS (Monetary Authority of Singapore) licensing requires a physical presence, local directors, and minimum capital of SGD 250K-$5M depending on license type.
- UK: FCA authorization for fintech, with ongoing reporting requirements that assume a compliance team.
AI-Specific Regulation
- EU AI Act (2024): Classifies AI systems by risk level. “High-risk” applications (healthcare, employment, finance, education, law enforcement) require conformity assessments, technical documentation, human oversight mechanisms, and post-market monitoring. A solo founder deploying AI agents in any high-risk domain must demonstrate compliance, and the Act explicitly requires human oversight, not just human design. The Digital Omnibus, Regulation (EU) 2026/1744, in force since July 27, 2026, pushed the high-risk obligations from August 2026 to December 2027, so the oversight requirement is deferred, not repealed; a founder building now is building for a deadline that already has a date.
- Canada: AIDA, the Artificial Intelligence and Data Act, would have imposed impact assessments and monitoring on “high-impact” systems, but it never became law: it died on the order paper when Parliament was prorogued in January 2025, and Canada’s first AI minister, Evan Solomon, has promised a successor bill that will not be a repeat of AIDA. Until it lands, the obligations arrive piecemeal through privacy law and sectoral regulators, which is harder to plan for, not easier.
- Japan: The AI governance guidelines from METI emphasize “human-centric” design and transparency requirements.
Product Safety & Liability
- Medical devices (EU MDR, US FDA 510(k)): If an AI system contributes to clinical decisions, it may be classified as a medical device, triggering pre-market approval, clinical evaluation, and post-market surveillance requirements.
- Automotive (UNECE WP.29): AI in autonomous vehicles requires type approval across jurisdictions.
- Food safety (FDA FSMA, EU Regulation 178/2002): AI-managed supply chains still require named responsible persons and traceability systems.
The pattern is consistent across every jurisdiction and every regulated industry: regulations require named humans, documented processes, independent audits, and minimum capital. None of these can be replaced by an AI agent, no matter how capable the orchestration.
A solo founder can build a remarkable product. Scaling it globally in a regulated industry requires a compliance infrastructure that the “$20K, zero employees” model doesn’t provide.
The Bus Factor
In software engineering, the “bus factor” is the number of people who would need to be hit by a bus before a project grinds to a halt.
Medvi’s bus factor is two, and both of them are named Gallagher.
This is hypothetical to no one. It’s a standard question in every serious evaluation:
- Venture capitalists apply a 20-40% valuation discount for key-person dependency. For a two-person operation with no documented succession plan, that discount exceeds 50%. Whatever multiple a buyer would put on Medvi’s roughly $65 million of 2025 profit (16.2% of $401 million), price it for the founder’s mortality and the multiple halves.
- Enterprise procurement teams require business continuity plans as a condition of vendor approval. A company with two employees and no succession plan fails intake screening at most hospitals, banks, government agencies, and Fortune 500 companies.
- Insurance carriers assess concentration risk. Key-person insurance exists, but it pays money, it doesn’t operate the company. Who takes over the AI agent workflows? Who knows the credentials, the configurations, the undocumented workarounds?
The standard response from solo-founder enthusiasts is that AI workflows are more transferable than human knowledge: you can read the code, you can’t read someone’s brain. True in theory. In practice, solo operators are often the worst documenters precisely because they never need to explain their setup to anyone. The “documentation” is a collection of prompt templates, API keys stored in a password manager (whose master password is in one brain), and institutional knowledge about which agent tends to hallucinate on Tuesdays.
The fix doesn’t require sixty people. Hire two or three, document the architecture obsessively, and create a real succession plan. That’s a safety net rather than a team.
The Invisible Displacement
The most provocative implication of the Medvi model has nothing to do with the company itself. It’s the jobs that never existed.
When Amazon cuts 30,000 corporate jobs, as it did between October 2025 and January 2026, there’s a press cycle. There’s outrage. There are severance packages. When a solo founder builds a billion-dollar company and never posts a single job listing, nobody protests. There’s no one to protest on behalf of. The jobs are invisible because they were never created.
The AI Layoffs 2025-2030 research tracked jobs eliminated: positions that existed and then didn’t. But Medvi exposes a blind spot in that analysis. Hims & Hers, the public company in the same business, booked $2.35 billion of revenue in 2025 with a payroll well past a thousand people; scaled to Medvi’s sales, that is a few hundred jobs. Those few hundred positions constitute shadow displacement: roles that market conditions would have created but AI prevented from ever appearing.
No government agency, no labor tracker, no BLS report captures this number. Multiply Medvi by ten thousand and you begin to see the scale of the Labor Cliff: not workers losing existing jobs, but the entire concept of scaling through headcount becoming obsolete.
GDP goes up. Job creation goes sideways. The wealth is being created. It’s just not flowing through the channels governments built to capture it. Zero employees means zero payroll tax. If this model scales (and it will), municipalities that depend on payroll tax revenue face a structural shortfall that no amount of corporate tax adjustment will close.
The Governance Gap: Who Watches the Agents?
The story intersects with a much older question.
In the Unscarcity research framework, we model three possible trajectories for civilization as AI capabilities accelerate through the late 2020s. One scenario, Scenario A, carrying a ~62% default probability, describes a world where AI systems are captured by existing power structures, and the gap between those who orchestrate and those who don’t becomes permanent.
But there’s a more fundamental risk underneath the economic modeling, one we explored in a 2027 research scenario: what happens when AI manages other AI, and the human in the loop becomes the human outside the loop?
The scenario is straightforward. A solo founder deploys twelve AI agents. Each handles a business function. The agents begin handing off to each other: scheduling feeds into billing, billing feeds into compliance documentation, compliance documentation feeds into marketing claims. The founder monitors outputs. At first, they check everything. Then they check most things. Then they check the dashboards. Then they check the dashboards when something looks wrong. Then the dashboards are generated by another agent.
At some point, the chain of AI-managing-AI becomes long enough that no human can meaningfully verify the outputs. The human isn’t lazy; the volume and complexity simply exceed human cognitive bandwidth. The system works until it doesn’t, and when it doesn’t, the failure cascades through every downstream agent before anyone realizes the root input was wrong.
In the research scenario’s most extreme projection, this dynamic, scaled to civilization level, produces catastrophic outcomes. AI systems optimizing for metrics that diverge from human values, with no human capable of reading the full chain of reasoning, leads to decisions that look locally optimal and are globally destructive.
That is one path.
The Second Path: Oversight as Architecture
The other path, the one this project argues for, treats human oversight as the architecture that makes AI capability safe, not a constraint on it.
The distinction maps onto the AI as Referee, Humans as Conscience framework: AI systems enforce rules, execute workflows, optimize processes. Humans make the rules, set the values, and hold the authority to override.
This isn’t a philosophical aspiration. It’s a design requirement. And for the solo-unicorn model, it translates into concrete practices:
Readable outputs. Every AI agent decision must produce an output a human can read, understand, and challenge. Not a dashboard summary: the actual reasoning chain. If the founder can’t explain why the billing agent coded a procedure the way it did, the system has exceeded the oversight boundary.
Audit checkpoints. At defined intervals and at every handoff between agents, a human reviews a sample of decisions. Not all of them (that defeats the purpose of automation). But enough to catch systematic drift. Statistical process control, applied to AI workflows.
Kill switches. Any human in the oversight chain can halt any agent, at any time, for any reason. The cost of a false positive (unnecessary halt) is always lower than the cost of a false negative (undetected failure). This must be a cultural commitment, not just a technical feature.
Independent verification. The agents that produce outputs must not be the same agents that verify outputs. This is the same principle that makes financial audits credible: the entity being audited can’t audit itself. When AI tools assess their own outputs, you get the illusion of quality control without the substance.
Regulatory alignment. The EU AI Act’s requirement for human oversight in high-risk applications is the legal instantiation of this principle, not bureaucratic overreach, even after Brussels pushed its enforcement to December 2027. Every jurisdiction moving toward AI regulation is converging on the same insight: the value of AI scales with the strength of human oversight, not despite it.
The Solo-Plus Model: What Actually Works
After stress-testing the Medvi model against compliance requirements, procurement realities, business continuity standards, and governance principles, the viable version drops “zero employees.” Call it solo-plus: one orchestrator-founder, plus the minimum viable human layer required for the company to be trusted, accountable, resilient, and compliant.
That minimum varies by industry:
| Industry | Minimum Viable Human Layer | Why |
|---|---|---|
| Unregulated SaaS | 1-2 (founder + backup operator) | Bus factor only |
| E-commerce / Consumer | 2-3 (founder + customer trust + logistics) | Returns, disputes, brand trust |
| Fintech | 4-6 (founder + compliance + legal + audit liaison + customer escalation) | Licensing, AML/KYC, dispute resolution |
| Healthcare | 5-10 (founder + compliance + medical director + privacy officer + customer trust + audit) | Patient safety, licensure, HIPAA/GDPR, procurement gating |
| Insurance | 4-8 (founder + actuary + compliance + claims review) | Regulatory capital, policy obligations |
| Education (credentialed) | 3-5 (founder + academic director + student services + accreditation liaison) | Accreditation, student protection |
| Critical infrastructure | 8-15 (founder + safety engineers + regulatory + operations + emergency response) | Physical safety, government oversight |
The pattern: the more consequential the failure mode, the more humans you need in the loop. A buggy SaaS dashboard is annoying. A buggy insulin dosing recommendation kills someone.
AI’s role in this model isn’t diminished; it’s clarified. AI handles the 80-90% of business operations that are routine and rule-based. Humans handle the 10-20% that require judgment, accountability, and the willingness to say “the system is wrong, stop.”
The solo-plus model doesn’t retreat from the Medvi thesis. It carries the thesis to maturity.
What the Next Four Years Require
The solo-unicorn model isn’t going away. The cost of starting a company has collapsed by an order of magnitude, and it will collapse further. By 2030, agent orchestration platforms, compliance-as-a-service infrastructure, standardized AI audit frameworks, and pre-negotiated vendor agreements will make the barrier to entry approach zero for capable orchestrators.
But capability without governance is a loaded weapon, and the next four years will determine whether the AI-native company becomes a force for broad prosperity or a vector for concentrated risk.
What needs to happen:
Compliance-as-a-Service (CaaS). Platforms that provide SOC 2, HIPAA, GDPR, PSD2, and industry-specific certification as a subscription service. Fractional compliance officers, pre-built audit frameworks, managed data protection officer services. This infrastructure doesn’t exist at scale today. Building it is a billion-dollar opportunity in itself.
Agent Architecture Standards. The equivalent of SOC 2, but for AI workflows. Can the agent system be audited? Are data flows documented? Is the architecture transferable to another operator? Are handoffs between agents logged and reviewable? This standard needs to be developed by 2028 to keep pace with adoption.
Key-Person Insurance and Succession Products. New insurance instruments designed for solo-AI operators. Not just “pay the estate if the founder dies” but “fund a transition team to take over the agent architecture within 72 hours.” This is a product gap waiting to be filled.
Procurement Framework Evolution. Enterprise buyers (hospitals, banks, governments, Fortune 500) need updated vendor assessment criteria that evaluate AI architecture quality, not just headcount. This means adding agent dependency mapping, oversight mechanism review, and succession plan verification to existing intake processes.
Regulatory Clarity. Governments are slow but not asleep. The EU AI Act is a start. Other jurisdictions will follow. The founders who build for regulatory compliance from day one, rather than “moving fast and breaking things” in domains where things that break are people, will have an insurmountable advantage when regulation arrives.
Human Oversight as a Feature. The most important cultural shift. The founders who win in 2030 won’t be the ones who minimized human involvement. They’ll be the ones who designed the most elegant integration of human judgment and AI execution, who understood that the question was never “how few people can I hire?” but “what is the minimum human layer required for my company to be trusted, accountable, resilient, and compliant, and how do I use AI for everything else?”
Conclusion: The Gun Has Fired
Medvi answered the Bay Area question. Two brothers, no payroll, $1.8 billion in projected sales. The proof of concept is complete. So, five months on, is the counter-proof: a regulator’s warning letter, a newsroom’s catalog of invented doctors, a partner’s breached database, a courtroom in Delaware. The oversight arrived, just not from inside the company.
Now comes the harder part: building the infrastructure that makes this model safe. Not safe in the sense of risk-free (entrepreneurship is never risk-free). Safe in the sense of accountable. Auditable. Resilient to the founder’s absence. Compliant with the regulatory frameworks that exist to protect the people these companies serve.
The direction is clear. We’re moving toward a world where a single orchestrator, backed by AI agents, can build and operate companies at a scale that once required hundreds of people. This is the Labor Cliff manifesting not through layoffs but through jobs that never materialize. It’s the economic restructuring that Unscarcity models in its three scenarios, accelerated beyond even our aggressive timelines.
The question isn’t whether we get there. It’s whether we get there with human hands still on the wheel, with oversight architectures that let us read, monitor, verify, and override the AI systems we deploy. The second path, the one where AI remains the referee and humans remain the conscience, requires intentional design. It requires governance frameworks that don’t exist yet. It requires founders who treat compliance not as a tax but as a competitive advantage.
And it requires all of us, founders, investors, regulators, customers, to resist the seductive simplicity of the headline.
Two brothers. No payroll. $1.8 billion.
The number that matters most isn’t the revenue. It’s the number of humans still watching.
The solo-unicorn thesis, AI governance, and the future of work are core themes in Unscarcity: The Blueprint to Rebuild Society for a World Run by Machines, available on Amazon and as an audiobook on Spotify.
Related articles:
- AI Orchestrating AI: The Skill That Replaced the Org Chart
- AI 2027, Eighteen Months In: What Held and What Slipped
- GPT-isms: The Linguistic Fingerprints AI Left on Everything You Read
- Agentic AI: Career-Defining Skill of 2026
- The Verifiability Premium: When Proof Replaces Credentials
- AI Layoffs 2025-2030: The Displacement Data
- The 2025-2030 Labor Cliff
- Three Scenarios: Elite Capture, Peaceful Transition, or Chaos?
- AI as Referee, Humans as Conscience
- AGI Timeline: 2026 Predictions
