• Technological Optimization: A founder leveraged over a dozen artificial intelligence tools to automate coding, marketing, customer service, and business process analysis.
• Rapid Scaling: The startup Medvi reached high revenue milestones quickly by utilizing existing telehealth infrastructure to facilitate the distribution of prescription medications.
• Capital Efficiency: With only two employees and minimal initial investment, the enterprise reported substantial annual sales and profit margins surpassing traditional competitors.
• Automation Focus: Operations are structured around AI agents and software systems that handle day-to-day business functions, reducing the need for significant human staff.
• External Partnerships: The business model relies on third-party platforms to manage clinical requirements, including interactions with medical doctors and physical product fulfillment.
• Lean Philosophy: The founder deliberately avoids large-scale hiring based on previous experience suggesting that human teams can complicate decision-making and increase fixed costs.
• Agile Iteration: The company continuously expands its product offerings, moving into new categories like men’s health and nutrition through automated operational adjustments.
• Strategic Philanthropy: A portion of generated profits is allocated toward a private foundation intended to support social causes, including homelessness and animal welfare.

---

Matthew Gallagher, 41, built his start-up, Medvi, with artificial intelligence and few humans.Credit...Maggie Shannon for The New York Times

Supported by

SKIP ADVERTISEMENT

Listen · 13:09 min

By Erin Griffith

Reporting from Los Angeles

• April 2, 2026

Matthew Gallagher took just two months, $20,000 and more than a dozen artificial intelligence tools to get his start-up off the ground.

From his house in Los Angeles, Mr. Gallagher, 41, used A.I. to write the code for the software that powers his company, produce the website copy, generate the images and videos for ads and handle customer service. He created A.I. systems to analyze his business’s performance. And he outsourced the other stuff he couldn’t do himself.

His start-up, Medvi, a telehealth provider of GLP-1 weight-loss drugs, got 300 customers in its first month. In its second month, it gained 1,000 more. In 2025, Medvi’s first full year in business, the company generated $401 million in sales.

Mr. Gallagher then hired his only employee, his younger brother, Elliot. This year, they are on track to do $1.8 billion in sales.

A $1.8 billion company with just two employees? In the age of A.I., it’s increasingly possible.

Sam Altman, the chief executive of OpenAI, predicted the rise of a new breed of superefficient company in 2024. A one-person business worth $1 billion “would have been unimaginable without A.I.,” he said on a podcast, “and now it will happen.”

Now as A.I. tools spread, entrepreneurs are harnessing the technology to expand their start-ups to an enormous scale at breathtaking speed with very few humans. Big companies, especially in tech, are getting in on the disruption, too. Pinterest, Block and others have cut thousands of workers in recent months, citing efficiencies enabled by A.I.

Mr. Gallagher, who formerly ran a start-up that sold wristwatches, said he thought Mr. Altman’s prophecy of a one-person $1 billion company would be a firm that built A.I. He was excited when he realized he may have done it, taking an old idea — being a middleman for weight-loss drugs — and using A.I. to turbocharge it.

“It’s not an A.I. company, but I did it with A.I.,” he said.

In an email, Mr. Altman said that it appeared he had won a bet with his tech C.E.O. friends over when such a company would appear, and that he “would like to meet the guy” who had done it.

Medvi is technically not a one-person $1 billion company, since Mr. Gallagher hired his brother and has some contractors. The start-up, which has not raised outside funding, also has no official valuation. But many highly valued tech companies can only dream of hitting $1 billion in revenue with so few workers. Medvi is also profitable, Mr. Gallagher said.

The New York Times was given access to Medvi’s financials to verify its revenue and profits and interviewed Mr. Gallagher’s business partners.

On a recent afternoon at the Soho House club in Los Angeles, Mr. Gallagher, sporting unkempt curly hair, a baggy T-shirt and tattoos on his arms and hands, said the last 18 months had been a whirlwind.

He works on Medvi from his house basically anytime he’s not showering, sleeping or spending time with his two children, he said during a two-hour conversation. He even made an A.I. clone of his voice to help manage his personal life, using it to call and schedule appointments so he would have more time to work.

Not everyone can build such an A.I.-enabled company, though many may try. Mr. Gallagher is suited to the moment because he knows marketing and how to use cutting-edge A.I., said Kobie Fuller, an investor at the venture capital firm Upfront Ventures who has advised him.

“Those folks that have those skills, it’s kind of like their superpower,” Mr. Fuller said. “This is an extreme example, but I don’t think it’s going to be the last by any stretch.”

Mr. Gallagher has told hardly anyone about his company, which he said was raking in more than $3 million a day. He was nervous to talk publicly about it, he said.

“I mean, it’s crazy, right?” he asked, before answering himself. “It’s crazy.”

Spotting Opportunity

Mr. Gallagher had an itinerant childhood, living out of motels and cars for a time before landing in Cincinnati when he was 12. That was where his uncle gave him a laptop, which he used to teach himself to code so he could make a Weird Al Yankovic fan page.

As a teenager, Mr. Gallagher began building websites for local businesses. He always had a hustle, including selling candles and Samurai swords on eBay. At 18, after building a web hosting business, he sold it for $6,000.

Mr. Gallagher briefly attended the University of Cincinnati and Northern Kentucky University but did not graduate. In 2010, he moved to Los Angeles to become an actor. He eventually returned to coding, bouncing between tech jobs.

In 2016, he built Watch Gang, a start-up that sold wristwatches via subscription. It had fans but never turned a profit, even as Mr. Gallagher chased revenue growth and hired 60 people.

OpenAI’s release of ChatGPT in 2022 inspired Mr. Gallagher to start tinkering with A.I. Two years later, he met Jiten Chhabra, a co-founder of CareValidate, a medical start-up in Atlanta.

CareValidate offers what is essentially a telehealth-in-a-box kit. Companies, employers or retailers that want to sell customers prescription drugs can use CareValidate’s technology and network of online doctors to set up a business. The company’s software connects patients with doctors and pharmacies, which write, fulfill and ship the prescriptions. CareValidate charges fees for its software.

Mr. Gallagher saw an opportunity for his own telehealth business. He could use A.I. to do the branding and marketing and let CareValidate and a similar platform, OpenLoop Health, handle the doctors, pharmacies, shipping and compliance. He planned to start with GLP-1s.

He was entering an established market. For nearly a decade, Hims & Hers Health, Ro and other companies have sold drugs for erectile dysfunction and hair loss online, using an online network of doctors to write the prescriptions. Hims, which went public in 2021, has 2,442 employees and generated $2.4 billion in revenue last year.

Hims and Ro had already expanded into GLP-1 drugs, but Mr. Gallagher thought he could do the same thing faster and more efficiently with A.I. and the doctor-on-demand platforms.

He used many A.I. tools to build Medvi’s website, including ChatGPT, Claude and Grok. He created custom tools, including A.I. agents, or bots that perform tasks on their own, to get his software systems to communicate with one another. He tested A.I. voice tools from ElevenLabs and others for communicating with customers. And he used the image and video generators Midjourney and Runway to create media for his website and ads.

Altogether, he spent $20,000 on the software and the first month of marketing.

Medvi’s initial website featured photos of smiling models who looked A.I.-generated and before-and-after weight-loss photos from around the web with the faces changed. Some of its ads were A.I. slop. A scrolling ticker of mainstream media logos made it look as if Medvi had been featured in Bloomberg and The Times when it had merely advertised there.

But Mr. Gallagher was most concerned with getting Medvi’s checkout to work smoothly and making sure his A.I. customer service system stuck to the task at hand. He tested it by asking the system for lasagna recipes; it took some tweaking to get it to stop supplying them, he said.

Medvi opened for business in September 2024. It was perfectly timed. Americans wanted cheap GLP-1s, delivered without going to a doctor’s office. The start-up charged as little as $179 for the first month’s supply of the drugs, in line with competitors.

Image

To build Medvi, Mr. Gallagher used A.I. tools including ChatGPT, Claude, Grok, Midjourney and Runway.Credit...Maggie Shannon for The New York Times

The Sky’s the Limit?

From the beginning, “growth was insane,” Mr. Gallagher said.

Medvi quickly became one of CareValidate’s and OpenLoop’s top clients. The companies said they were blown away by the start-up's speed and scale.

“You’re like, ‘Do you have an army of people behind you somewhere?’ And he’s like, ‘Nope,’” CareValidate’s Mr. Chhabra said of Mr. Gallagher.

Dr. Jon Lensing, OpenLoop’s chief executive, said Mr. Gallagher had started sharing tech tips with his company. “Matthew’s native tongue seems to be A.I.,” he said.

There were snags. Medvi’s customer service chatbot sometimes made up prices for the drugs. (Mr. Gallagher honored those.) Or it hallucinated, claiming Medvi sold hair-loss drugs when it didn’t.

If customers wanted to talk to a person, Medvi’s customer service chatbot had been trained to transfer them to Mr. Gallagher’s cellphone. That led to more than 1,000 customer service calls, he recalled.

To manage the onslaught, he integrated programs from OpenLoop and CareValidate that fielded customer service calls. Mr. Gallagher soon graduated from using the online legal site LegalZoom to using a law firm, and from using A.I. accounting tools to using an accounting firm. He also hired media agencies to help buy ads to entice customers.

As sales took off, Mr. Gallagher asked Mr. Fuller, the venture capital investor, if he should raise venture funding. Mr. Fuller told him that if he didn’t need the money, he shouldn’t raise it.

“You should just keep building,” Mr. Fuller said he had told Mr. Gallagher. Mr. Gallagher later thanked him for the advice.

In March last year, Mr. Gallagher changed something minor on Medvi’s website and then went on a hike. From the trail, he got a call from one of his media agencies asking whether it was odd that there had been no orders for the last hour.

Mr. Gallagher realized that his update must have broken something. With no one to fix it, he sprinted home. The downtime lost him around 200 potential customers, he said.

Still, he was hesitant to hire anybody. At Watch Gang, having 60 employees had not helped the company grow.

“It just increased my costs, and then it delayed my decision-making because I had more people to deal with,” he said. Medvi’s biggest advantage was his ability to move quickly, he said.

Mr. Gallagher added two engineers on contract and decided to hire only Elliot, his 36-year-old brother in Cincinnati in April. Elliot’s job includes intercepting and filtering communication so Matthew can focus on his priorities.

“I just helped take a lot of the weight off of him,” Elliot Gallagher said in an interview.

That gave Matthew Gallagher breathing room to fix some shortcuts he had initially taken, like swapping out the before-and-after weight-loss photos for ones from real customers. Some photos on Medvi’s homepage remain A.I.-generated.

By the end of last year, Medvi had reached $401 million in annual sales and amassed 250,000 customers. It produced 16.2 percent in net profit, or $65 million, with spending going to the fees for telehealth platforms, marketing and then software. Hims, by contrast, had a net profit of 5.5 percent last year.

Mr. Gallagher is reinvesting some of Medvi’s profits into expansion. He considered buying companies that provide other health products, but decided it was just as easy to build himself.

In February, Medvi started selling men’s health products, including erectile dysfunction drugs. That business hit 50,000 customers in the first month and is on track to eclipse the GLP-1 business in four months, Mr. Gallagher said.

Last month, Medvi added healthy meal delivery plans, which OpenLoop handles. Next up is women’s health, including hormone therapy drugs. Hair-growth drugs, supplements and skin care products are also on the agenda.

Medvi’s total profit of $70 million to $80 million so far has made Mr. Gallagher emotional, given his upbringing.

“For the first time, I’m not in survival mode,” he said.

Last year, he set up a foundation with $1 million and donated to a Los Angeles cat rescue organization, with plans to also donate to a nonprofit that helps young people experiencing homelessness. His goal is to run most of Medvi’s profits through the foundation. For fun, he invests in films and buys historical items, including a pocket watch from the 1700s.

Mr. Gallagher does not anticipate hiring more people. He said he just didn’t see how it would help Medvi, though he misses the camaraderie of colleagues.

“At this point, I kind of want to hire people because I’m lonely,” he said.

But some human touch is still needed.

In September, Medvi began assigning human account managers to a subset of customers. When those customers call, text or email with a question, they connect to the same account manager. The idea is that the account managers will get to know clients and remember details like birthdays or children’s names, creating higher customer satisfaction.

Medvi’s seven account managers, all hired on contract, now have several hundred clients each. To manage that many relationships, they are using A.I.

Erin Griffith covers tech companies, start-ups and the culture of Silicon Valley from San Francisco.

Related Content

Advertisement

SKIP ADVERTISEMENT

“Thanks, Mr President, but no thanks.” That is what Benjamin Netanyahu should have said when Donald Trump responded to Israel’s request for “resupply priority” by intervening directly in its air assault on Iran. Israel, after all, has always craved US weapons — which were rigorously denied when they were most needed in the years before the 1967 war — but its leaders never wanted America to do any of the fighting. When, for instance, US Patriot batteries and their crews were rushed in to counter Iraqi missiles during the Gulf War, Israeli operators took over very quickly, compressing weeks of training into a matter of days. 

The US has too many other interests — both in the Middle East and beyond — to be Israel’s unconstrained ally in its endless fight for survival. And then there is the sharp “post-heroic” asymmetry between the two nations. American tolerance for war casualties is certainly still higher than Europe’s, where President Macron abandoned 1.9 million square miles across the Sahel, long secured by just 5,000 French troops, to the jihadis, apparently terrified that 10 might be killed at once. When that number of French troops died on a single day in Afghanistan, President Sarkozy’s presidency was irredeemably ruined. 

Since October 7, 2023, Israel has lost 1,152 soldiers without political consequence — whereas Trump would be impeached, with plenty of Republican votes, if a population-proportionate 50,732 Americans were killed while fighting Iran. The same is probably true even if that number were halved, or quartered.   

More generally, meanwhile, Netanyahu should have declined Trump’s heart-warming offer to be Israel’s superpower ally because of the very same free-wheeling pragmatism that induced Trump to get involved. Pragmatism has its virtues, and so does Trump’s perpetual optimism. But there are still some unyielding realities in this world, including geographic ones. One of these is that about a fifth of the world’s oil, about a fourth of its liquid natural gas, and over 10% of its fertilizer, travels through the Strait of Hormuz. 

Iran’s naval warships and submarines are no more, and even the Revolutionary Guards’ motorboats are mostly destroyed. But there are still at least 10 islands that must be denied to infiltrated Revolutionary Guard units to ensure the Persian Gulf’s navigable channels are truly safe. There are also some 1,500 miles of Iranian coastline, every mile of which must be constantly surveilled, in granular detail, to detect and destroy any anti-ship missile launcher or similar threat.

That calls for quite a lot of deployable troops — many more than the 5,000 Marines bandied about these days — with the resultant exposure to casualties. The US may be more willing to bear casualties than Europe, but each death nonetheless entails a political cost much higher than was the case during the Vietnam War, whose soldiers were born when the US fertility rate was well over 3.5. Every death is a tragedy, obviously, but losses must be even more intolerable now that few families have more than one child. 

One can see why some perfectly reasonable people respond to all this by asserting the simple truth that American power is ultimately generated by its own magnificently inventive society, kept in funds by the world’s most courageous investors — European financial prudence is now the biggest obstacle to European progress — and not by anything beyond America’s shores. It is now very possible to imagine a US that is still the leading superpower, by virtue of its vastly superior technology, but without being a global power. 

Abandoning the Persian Gulf to Iran’s Shia supremacists, who would quickly control the Arab side as well, would be a very long step in that direction, and there are even good excuses to assuage the shame factor. That is the “defection” of the European allies, whose very existence as independent states originated in the US decision to remain in Europe after the end of the Second World War. 

This defection was already very plain last year, with the frankly astonishing refusal of most European allies to acknowledge the deadly peril of Iran’s roughly 400 kilograms of 60% enriched uranium which, as the director general of the International Atomic Energy Agency patiently explained at the time, would allow Iran to produce at least 10 fission bombs in short order.

Yet when dozens of Israeli fighter bombers — and seven US B-2 stealth bombers — demolished Iran’s nuclear installations on 25 June last year, there was no outburst of gratitude across European capitals, each of which would otherwise have had to contend with nuclear-armed Revolutionary Guards, whose willingness to kill tens of thousands of their own citizens suggests a readiness to kill hundreds of thousands or millions of Western unbelievers. 

But there was no applause, no gratitude, no support — only more “anti-colonial” polemics against Israel, and even more anti-American resentment, as if the conjunction of nuclear weapons with fanatics waiting for the return of the Twelfth Imam and the “end of history” were not a danger unprecedented in history. 

This time around, when Israel’s aim was to prevent its own destruction from a gigantic barrage of Iranian missiles, by attacking missile factories and underground storage sites, and the US aim was to destroy the headquarters and depots of the Revolutionary Guards and their murderous Basij militia, with the faint hope of an uprising, the response was not just a lack of gratitude. It was outright sabotage through the denial of access to US bases or the prohibition of overflights. The first defector was Pedro Sánchez, Spain’s impeccably elegant bourgeois prime minister, who rules his country by herding over a dozen Leftist and regional separatist parties in coalition. 

It was not that Sánchez denied the support of his country’s armed forces — which feature such wonders as a pair of proudly Spanish-made submarines that cost as much as nuclear subs, and an army which has 150 generals for perhaps 4,000 combat-ready soldiers. What Sanchez denied was the use of the Rota naval station, and the Torrejón and Morón airbases, important for US deployments to the Middle East as the first refueling stops after crossing the Atlantic.  

President Macron, who long ago gave up his attempt to modernize France, followed by also denying US military overflights and, more ambitiously, trying to deny freight overflights carrying cargo for US bases. Even Giorgia Meloni — the same one who kept flying to Palm Beach to seek favor at Trump’s court — denied the use of the Sigonella airbase in Sicily.

The British government has been altogether more cooperative, quietly allowing unfettered use of US fighters stationed at RAF Lakenheath, and also the use of RAF Fairford with its especially long runways for the refueling transits of US bombers. Even so, Britain farcically demanded the right to approve individual targets; as if they were not routinely switched in the course of operations.

Trump’s reaction to the performative anti-Americanism of Sánchez, Macron and Meloni has an extra edge. But even Americans who intensely dislike Trump understand that a new elite anti-Americanism now exists across Europe, an embittered reaction to its glaring failure to keep up with US innovation. Yet now that the US has left Iran without an airforce or a navy, Trump has invited the Europeans — the very countries that need oil and gas from the Gulf — to send their own armed forces to secure the Strait. At the very least, they can gain recompense from the Arab states that Iran attacked. 

---

• Composite Methodology: The platform aggregates 10 independent AI benchmarks into a single normalized 0-100 score updated every Saturday.
• Tiered Weighting: Algorithms assign higher importance to contamination-resistant, objective pass/fail benchmarks over those susceptible to crowdsourced manipulation.
• Selection Criteria: Models are required to demonstrate performance across at least five distinct benchmarks to qualify for inclusion in the rankings.
• Performance Ranking: GPT-5.4 currently holds the lead position by maintaining high performance across multiple Tier 1 benchmarks despite lower individual rankings in some areas.
• Integrity Concerns: The ranking system explicitly devalues platforms like Chatbot Arena due to reported procedural issues and potential developer bias.
• Model Diversity: The index tracks 40 distinct models from 18 separate laboratories, categorizing them into open-weight and commercial classifications.
• Embeddable Infrastructure: Developers may integrate the rankings into external websites using a provided JavaScript widget hosted on GitHub.
• Historical Consistency: Initial charts utilize 12 weeks of backfilled data to ensure all newly introduced models begin from a standardized baseline.

---

Implicator.ai on Friday released the AI Top 40, a weekly chart that scrapes 10 independent benchmarks and boils them down to one number per model. Forty models from 18 labs made the cut. The chart updates every Saturday and anyone can embed it for free.

The system pulls raw scores from Chatbot Arena, SWE-bench Verified, GPQA Diamond, ARC-AGI, Humanity's Last Exam, LiveCodeBench, MMLU-Pro, HELM, Artificial Analysis, and the HuggingFace Open LLM Leaderboard. It normalizes them using Z-score standardization and applies a three-tier weighting system we call the Implicator Algorithm.

Key Takeaways

• The AI Top 40 aggregates 10 independent benchmarks into a single 0-100 composite score, updated every Saturday
• Contamination-resistant benchmarks like SWE-bench and ARC-AGI carry 4x the weight of Chatbot Arena in the composite
• GPT-5.4 leads with 100.0 despite Claude Opus 4.6 topping Arena, because it qualifies on 8 benchmarks vs. Claude's 5
• The chart ranks 40 models from 18 labs and is free to embed on any website via a public GitHub widget

AI-generated summary, reviewed by an editor. More on our AI guidelines.

How the weighting works

Not all benchmarks carry equal influence. The algorithm assigns 2.0x weight to five Tier 1 benchmarks that resist data contamination and use objective pass/fail scoring: SWE-bench, LiveCodeBench, GPQA Diamond, ARC-AGI, and HLE. HELM, Artificial Analysis, and HuggingFace get 1.0x as Tier 2. Chatbot Arena and MMLU-Pro sit at 0.5x, meaning Tier 1 benchmarks contribute four times more to a model's composite than Tier 3.

That last decision will draw attention. Chatbot Arena, the crowdsourced benchmark that has become AI's most influential ranking, gets the lowest weight. The reason is blunt: the game is rigged. The "Leaderboard Illusion" paper by researchers at Cohere, Stanford, MIT, and Allen AI audited 2 million Arena battles and found that select labs could privately test dozens of model variants before publishing only the best score. Meta tested 27 private Llama-4 variants in a single month before the public launch. Twenty-seven.

A model must appear on at least 5 of 10 benchmarks to qualify. An earlier experiment with a minimum of 3 caused statistical inflation, allowing models that happened to score well on a narrow set of favorable tests to outrank models measured honestly across eight.

GPT-5.4 holds the top spot

The current rankings, published March 28, put OpenAI's GPT-5.4 at #1 with a perfect 100.0 composite. Claude Opus 4.6 sits at #2 with 93.2. Grok 4 takes third at 86.6. Sharp-eyed readers will notice every model currently shows 12 weeks on the chart. That is because we seeded the system by backfilling 12 weeks of historical data from the same benchmark snapshot. Everyone entered on the same starting line. The counter will start diverging as new models qualify and older ones drop off in future weeks.

Get the AI Top 40 in your inbox

Strategic AI news from San Francisco. No hype, no "AI will change everything" throat clearing. Just what moved, who won, and why it matters. Daily at 6am PST.

No spam. Unsubscribe anytime.

That result contradicts Chatbot Arena, where Claude Opus 4.6 holds #1 with an Elo rating of 1,504. But Arena carries 0.5x weight in the composite. GPT-5.4 qualifies on eight benchmarks, including all five in Tier 1. Claude qualifies on five and is absent from GPQA Diamond, MMLU-Pro, and HELM, three benchmarks where GPT-5.4 scores near the top.

Same logic as a decathlon. Win the 100-meter sprint by a mile, still lose to the athlete who placed well in eight events. The algorithm rewards breadth of verified performance, not dominance on a single structurally compromised leaderboard.

The open-weight picture

Alibaba's Qwen 3 235B ranks #8 overall. That makes it the highest open-weight model on the chart, sitting above Claude Opus 4, o3, o4-mini, Gemini 2.5 Pro, and GPT-4.1. DeepSeek's two entries, R1 at #16 and V3 at #21. Meta's Llama 4 Maverick landed at #31.

Eleven of the 40 qualifying models carry open weights. The chart splits into three views generated from the same underlying data: an Open Weights board (green), a Commercial board (gold), and an All Models board covering both. Here is the live Open Weights board:

Why another ranking

Benchmark data is abundant but scattered across a dozen sites with a dozen scoring systems. SWE-bench reports percentage of resolved GitHub issues. Arena spits out Elo ratings. MMLU-Pro gives you a number out of 100. Lining those up side by side tells you nothing, and cherry-picking whichever benchmark makes your model look best has become standard practice among labs announcing new models. Anyone who's tried to compare five models across five leaderboards knows the frustration firsthand.

The AI Top 40 sits alongside Implicator.ai's LLM Popularity Meter, where the editorial team assigns subjective satisfaction scores based on daily use. Vibes vs. data. Both update weekly, and they complement each other: the Popularity Meter captures which model a writer reaches for at 2 AM on deadline, while the AI Top 40 captures which model survives ten independent exams.

The format borrows from music

Casey Kasem would recognize it. The name pays tribute to the radio host who turned chart countdowns into a weekly American habit, and the design borrows accordingly. Rank numbers sit inside circles. Movement arrows show who climbed and who fell. "New entry" badges flag first appearances. Open it on your phone and the feeling is immediate: you're reading a printed chart from 1986, monospace type and all, except the entries are language models instead of pop singles.

Publishers and developers can grab the chart for their own pages. The widget ships as one JavaScript file, wrapped in a Shadow DOM so it stays out of your stylesheet's way. Two lines of HTML gets it running. Four chart variants, data from a public GitHub repository, cached on jsDelivr. Free to embed, attribution required. The Commercial board below is a live embed, running right here on this page with the same two lines of code:

Next update drops April 5. The full chart, methodology breakdown, and embed codes are live at implicator.ai/ai-top-40.

Frequently Asked Questions

What is the AI Top 40?

A weekly composite leaderboard from Implicator.ai that ranks large language models by aggregating scores from 10 independent benchmarks into a single 0-100 score using Z-score standardization and tier-weighted scoring.

Why does GPT-5.4 rank above Claude Opus 4.6 when Claude leads Chatbot Arena?

Chatbot Arena carries only 0.5x weight in the composite due to documented integrity issues. GPT-5.4 qualifies on 8 benchmarks including all five Tier 1 tests, while Claude qualifies on 5 and is absent from GPQA Diamond, MMLU-Pro, and HELM.

Which benchmarks carry the most weight?

Five Tier 1 benchmarks get 2.0x weight: SWE-bench Verified, LiveCodeBench, GPQA Diamond, ARC-AGI, and Humanity's Last Exam. These resist data contamination and use objective pass/fail scoring.

How many models qualify for the chart?

Forty models from 18 labs currently qualify. A model must appear on at least 5 of the 10 benchmarks to make the cut. Eleven are open-weight, 29 are commercial.

Can I embed the AI Top 40 on my website?

Yes. The embeddable widget requires two lines of HTML and is free to use with attribution. Four chart variants are available: all models, open weights, commercial, and a three-board combo. Code and data live in a public GitHub repository.

AI-generated summary, reviewed by an editor. More on our AI guidelines.

[

Open-Weights LLMs Score 94.8% on Custom Coding Benchmark, 4% Behind Claude Opus

Jannis Fedoruk-Betschki, Austrian founder of managed Ghost hosting platform Magic Pages, built a 20-task TypeScript benchmark modeled on six months of actual commits and tested 16 models against it. A

The Implicator

](https://www.implicator.ai/open-weights-llms-score-94-8-on-custom-coding-benchmark-4-behind-claude-opus/)

[

Implicator Launches Weekly LLM Popularity Meter Tracking Five AI Models

Implicator.ai on Sunday introduced the LLM Popularity Meter, an interactive editorial tool that scores five leading AI models weekly and explains the reasoning behind each rating. The meter tracks Cla

The Implicator

](https://www.implicator.ai/implicator-launches-weekly-llm-popularity-meter-tracking-five-ai-models/)

[

OpenAI Sells Labor. Anthropic Sells Principle. Both Are Negotiating.

San Francisco | Friday, March 6, 2026 OpenAI shipped GPT-5.4 on Thursday and the benchmarks told an interesting story. Reasoning barely budged. Professional task completion jumped 12 points. The comp

The Implicator

](https://www.implicator.ai/openai-sells-labor-anthropic-sells-principle-both-are-negotiating/)

AI News

Share X / Twitter LinkedIn Email

Marcus Schuler

San Francisco

Tech translator with German roots who fled to Silicon Valley chaos. Decodes startup noise from San Francisco. Launched implicator.ai to slice through AI's daily madness—crisp, clear, with Teutonic precision and sarcasm. E-Mail: marcus@implicator.ai

• Platform Origin: EmDash is a new, TypeScript-based content management system developed as an alternative to WordPress using AI coding agents.
• Security Architecture: The system utilizes isolated dynamic worker sandboxes for plugins, preventing them from accessing databases or filesystems without explicit permission.
• Licensing Model: EmDash is released under the MIT license, aiming to avoid the restrictive licensing dependencies often found in the WordPress ecosystem.
• Infrastructure Design: The platform is serverless and built on the Astro web framework, designed to scale to zero compute usage when idle.
• Financial Integration: Native support for the x402 standard allows site owners to implement pay-per-use content monetization directly within the CMS.
• Agent Compatibility: The system includes built-in tools such as an CLI, an MCP server, and specific agent skills to facilitate programmatic management via AI.
• Authentication Standards: EmDash employs passkey-based authentication by default to minimize risks associated with traditional password management.
• Migration Tools: The project provides specific utilities and exporters to import existing content and media from WordPress sites into the new environment.

---

Introducing EmDash — the spiritual successor to WordPress that solves plugin security

2026-04-01

• 

  Matt “TK” Taylor

• 

  Matt Kane

11 min read

The cost of building software has drastically decreased. We recently rebuilt Next.js in one week using AI coding agents. But for the past two months our agents have been working on an even more ambitious project: rebuilding the WordPress open source project from the ground up.

WordPress powers over 40% of the Internet. It is a massive success that has enabled anyone to be a publisher, and created a global community of WordPress developers. But the WordPress open source project will be 24 years old this year. Hosting a website has changed dramatically during that time. When WordPress was born, AWS EC2 didn’t exist. In the intervening years, that task has gone from renting virtual private servers, to uploading a JavaScript bundle to a globally distributed network at virtually no cost. It’s time to upgrade the most popular CMS on the Internet to take advantage of this change.

Our name for this new CMS is EmDash. We think of it as the spiritual successor to WordPress. It’s written entirely in TypeScript. It is serverless, but you can run it on your own hardware or any platform you choose. Plugins are securely sandboxed and can run in their own isolate, via Dynamic Workers, solving the fundamental security problem with the WordPress plugin architecture. And under the hood, EmDash is powered by Astro, the fastest web framework for content-driven websites.

EmDash is fully open source, MIT licensed, and available on GitHub. While EmDash aims to be compatible with WordPress functionality, no WordPress code was used to create EmDash. That allows us to license the open source project under the more permissive MIT license. We hope that allows more developers to adapt, extend, and participate in EmDash’s development.

You can deploy the EmDash v0.1.0 preview to your own Cloudflare account, or to any Node.js server today as part of our early developer beta:

Or you can try out the admin interface here in the EmDash Playground:

What WordPress has accomplished

The story of WordPress is a triumph of open source that enabled publishing at a scale never before seen. Few projects have had the same recognisable impact on the generation raised on the Internet. The contributors to WordPress’s core, and its many thousands of plugin and theme developers have built a platform that democratised publishing for millions; many lives and livelihoods being transformed by this ubiquitous software.

There will always be a place for WordPress, but there is also a lot more space for the world of content publishing to grow. A decade ago, people picking up a keyboard universally learned to publish their blogs with WordPress. Today it’s just as likely that person picks up Astro, or another TypeScript framework to learn and build with. The ecosystem needs an option that empowers a wide audience, in the same way it needed WordPress 23 years ago. 

EmDash is committed to building on what WordPress created: an open source publishing stack that anyone can install and use at little cost, while fixing the core problems that WordPress cannot solve. 

Solving the WordPress plugin security crisis

WordPress’ plugin architecture is fundamentally insecure. 96% of security issues for WordPress sites originate in plugins. In 2025, more high severity vulnerabilities were found in the WordPress ecosystem than the previous two years combined.

Why, after over two decades, is WordPress plugin security so problematic?

A WordPress plugin is a PHP script that hooks directly into WordPress to add or modify functionality. There is no isolation: a WordPress plugin has direct access to the WordPress site’s database and filesystem. When you install a WordPress plugin, you are trusting it with access to nearly everything, and trusting it to handle every malicious input or edge case perfectly.

EmDash solves this. In EmDash, each plugin runs in its own isolated sandbox: a Dynamic Worker. Rather than giving direct access to underlying data, EmDash provides the plugin with capabilities via bindings, based on what the plugin explicitly declares that it needs in its manifest. This security model has a strict guarantee: an EmDash plugin can only perform the actions explicitly declared in its manifest. You can know and trust upfront, before installing a plugin, exactly what you are granting it permission to do, similar to going through an OAuth flow and granting a 3rd party app a specific set of scoped permissions.

For example, a plugin that sends an email after a content item gets saved looks like this:

import { definePlugin } from "emdash";

export default () =>
  definePlugin({
    id: "notify-on-publish",
    version: "1.0.0",
    capabilities: ["read:content", "email:send"],
    hooks: {
      "content:afterSave": async (event, ctx) => {
        if (event.collection !== "posts" || event.content.status !==    "published") return;

        await ctx.email!.send({
          to: "editors@example.com",
          subject: `New post published: ${event.content.title}`,
          text: `"${event.content.title}" is now live.`,
         });

        ctx.log.info(`Notified editors about ${event.content.id}`);
      },
    },
  });

This plugin explicitly requests two capabilities: content:afterSave to hook into the content lifecycle, and email:send to access the ctx.email function. It is impossible for the plugin to do anything other than use these capabilities. It has no external network access. If it does need network access, it can specify the exact hostname it needs to talk to, as part of its definition, and be granted only the ability to communicate with a particular hostname.

And in all cases, because the plugin’s needs are declared statically, upfront, it can always be clear exactly what the plugin is asking for permission to be able to do, at install time. A platform or administrator could define rules for what plugins are or aren’t allowed to be installed by certain groups of users, based on what permissions they request, rather than an allowlist of approved or safe plugins.

Solving plugin security means solving marketplace lock-in

WordPress plugin security is such a real risk that <a href="http://WordPress.org" rel="nofollow">WordPress.org</a> manually reviews and approves each plugin in its marketplace. At the time of writing, that review queue is over 800 plugins long, and takes at least two weeks to traverse. The vulnerability surface area of WordPress plugins is so wide that in practice, all parties rely on marketplace reputation, ratings and reviews. And because WordPress plugins run in the same execution context as WordPress itself and are so deeply intertwined with WordPress code, some argue they must carry forward WordPress’ GPL license.

These realities combine to create a chilling effect on developers building plugins, and on platforms hosting WordPress sites.

Plugin security is the root of this problem. Marketplace businesses provide trust when parties otherwise cannot easily trust each other. In the case of the WordPress marketplace, the plugin security risk is so large and probable that many of your customers can only reasonably trust your plugin via the marketplace. But in order to be part of the marketplace your code must be licensed in a way that forces you to give it away for free everywhere other than that marketplace. You are locked in.

EmDash plugins have two important properties that mitigate this marketplace lock-in:

1. Plugins can have any license: they run independently of EmDash and share no code. It’s the plugin author’s choice.

2. Plugin code runs independently in a secure sandbox: a plugin can be provided to an EmDash site, and trusted, without the EmDash site ever seeing the code.

The first part is straightforward — as the plugin author, you choose what license you want. The same way you can when publishing to NPM, PyPi, Packagist or any other registry. It’s an open ecosystem for all, and up to the community, not the EmDash project, what license you use for plugins and themes.

The second part is where EmDash’s plugin architecture breaks free of the centralized marketplace.

Developers need to rely on a third party marketplace having vetted the plugin far less to be able to make decisions about whether to use or trust it. Consider the example plugin above that sends emails after content is saved; the plugin declares three things:

• It only runs on the content:afterSave hook

• It has the read:content capability

• It has the email:send capability

The plugin can have tens of thousands of lines of code in it, but unlike a WordPress plugin that has access to everything and can talk to the public Internet, the person adding the plugin knows exactly what access they are granting to it. The clearly defined boundaries allow you to make informed decisions about security risks and to zoom in on more specific risks that relate directly to the capabilities the plugin is given.

The more that both sites and platforms can trust the security model to provide constraints, the more that sites and platforms can trust plugins, and break free of centralized control of marketplaces and reputation. Put another way: if you trust that food safety is enforced in your city, you’ll be adventurous and try new places. If you can’t trust that there might be a staple in your soup, you’ll be consulting Google before every new place you try, and it’s harder for everyone to open new restaurants.

Every EmDash site has x402 support built in — charge for access to content

The business model of the web is at risk, particularly for content creators and publishers. The old way of making content widely accessible, allowing all clients free access in exchange for traffic, breaks when there is no human looking at a site to advertise to, and the client is instead their agent accessing the web on their behalf. Creators need ways to continue to make money in this new world of agents, and to build new kinds of websites that serve what people’s agents need and will pay for. Decades ago a new wave of creators created websites that became great businesses (often using WordPress to power them) and a similar opportunity exists today.

x402 is an open, neutral standard for Internet-native payments. It lets anyone on the Internet easily charge, and any client pay on-demand, on a pay-per-use basis. A client, such as an agent, sends a HTTP request and receives a HTTP 402 Payment Required status code. In response, the client pays for access on-demand, and the server can let the client through to the requested content.

EmDash has built-in support for x402. This means anyone with an EmDash site can charge for access to their content without requiring subscriptions and with zero engineering work. All you need to do is configure which content should require payment, set how much to charge, and provide a Wallet address. The request/response flow ends up looking like this:

Every EmDash site has a built-in business model for the AI era.

Solving scale-to-zero for WordPress hosting platforms

WordPress is not serverless: it requires provisioning and managing servers, scaling them up and down like a traditional web application. To maximize performance, and to be able to handle traffic spikes, there’s no avoiding the need to pre-provision instances and run some amount of idle compute, or share resources in ways that limit performance. This is particularly true for sites with content that must be server rendered and cannot be cached.

EmDash is different: it’s built to run on serverless platforms, and make the most out of the v8 isolate architecture of Cloudflare’s open source runtime workerd. On an incoming request, the Workers runtime instantly spins up an isolate to execute code and serve a response. It scales back down to zero if there are no requests. And it only bills for CPU time (time spent doing actual work).

You can run EmDash anywhere, on any Node.js server — but on Cloudflare you can run millions of instances of EmDash using Cloudflare for Platforms that each instantly scale fully to zero or up to as many RPS as you need to handle, using the exact same network and runtime that the biggest websites in the world rely on.

Beyond cost optimizations and performance benefits, we’ve bet on this architecture at Cloudflare in part because we believe in having low cost and free tiers, and that everyone should be able to build websites that scale. We’re excited to help platforms extend the benefits of this architecture to their own customers, both big and small.

Modern frontend theming and architecture via Astro

EmDash is powered by Astro, the web framework for content-driven websites. To create an EmDash theme, you create an Astro project that includes:

• Pages: Astro routes for rendering content (homepage, blog posts, archives, etc.)

• Layouts: Shared HTML structure

• Components: Reusable UI elements (navigation, cards, footers)

• Styles: CSS or Tailwind configuration

• A seed file: JSON that tells the CMS what content types and fields to create

This makes creating themes familiar to frontend developers who are increasingly choosing Astro, and to LLMs which are already trained on Astro.

WordPress themes, though incredibly flexible, operate with a lot of the same security risks as plugins, and the more popular and commonplace your theme, the more of a target it is. Themes run through integrating with functions.php which is an all-encompassing execution environment, enabling your theme to be both incredibly powerful and potentially dangerous. EmDash themes, as with dynamic plugins, turns this expectation on its head. Your theme can never perform database operations.

An AI Native CMS — MCP, CLI, and Skills for EmDash

The least fun part about working with any CMS is doing the rote migration of content: finding and replacing strings, migrating custom fields from one format to another, renaming, reordering and moving things around. This is either boring repetitive work or requires one-off scripts and  “single-use” plugins and tools that are usually neither fun to write nor to use.

EmDash is designed to be managed programmatically by your AI agents. It provides the context and the tools that your agents need, including:

1. Agent Skills: Each EmDash instance includes Agent Skills that describe to your agent the capabilities EmDash can provide to plugins, the hooks that can trigger plugins, guidance on how to structure a plugin, and even how to port legacy WordPress themes to EmDash natively. When you give an agent an EmDash codebase, EmDash provides everything the agent needs to be able to customize your site in the way you need.

2. EmDash CLI: The EmDash CLI enables your agent to interact programmatically with your local or remote instance of EmDash. You can upload media, search for content, create and manage schemas, and do the same set of things you can do in the Admin UI.

3. Built-in MCP Server: Every EmDash instance provides its own remote Model Context Protocol (MCP) server, allowing you to do the same set of things you can do in the Admin UI.

Pluggable authentication, with Passkeys by default

EmDash uses passkey-based authentication by default, meaning there are no passwords to leak and no brute-force vectors to defend against. User management includes familiar role-based access control out of the box: administrators, editors, authors, and contributors, each scoped strictly to the actions they need. Authentication is pluggable, so you can set EmDash up to work with your SSO provider, and automatically provision access based on IdP metadata.

Import your WordPress sites to EmDash

You can import an existing WordPress site by either going to WordPress admin and exporting a WXR file, or by installing the EmDash Exporter plugin on a WordPress site, which configures a secure endpoint that is only exposed to you, and protected by a WordPress Application Password you control. Migrating content takes just a few minutes, and automatically works to bring any attached media into EmDash’s media library.

Creating any custom content types on WordPress that are not a Post or a Page has meant installing heavy plugins like Advanced Custom Fields, and squeezing the result into a crowded WordPress posts table. EmDash does things differently: you can define a schema directly in the admin panel, which will create entirely new EmDash collections for you, separately ordered in the database. On import, you can use the same capabilities to take any custom post types from WordPress, and create an EmDash content type from it. 

For bespoke blocks, you can use the EmDash Block Kit Agent Skill to instruct your agent of choice and build them for EmDash.

Try it

EmDash is v0.1.0 preview, and we’d love you to try it, give feedback, and we welcome contributions to the EmDash GitHub repository.

If you’re just playing around and want to first understand what’s possible — try out the admin interface in the EmDash Playground.

To create a new EmDash site locally, via the CLI, run:

npm create emdash@latest

Or you can do the same via the Cloudflare dashboard below:

We’re excited to see what you build, and if you're active in the WordPress community, as a hosting platform, a plugin or theme author, or otherwise — we’d love to hear from you. Email us at emdash@cloudflare.com, and tell us what you’d like to see from the EmDash project.

If you want to stay up to date with major EmDash developments, you can leave your email address here.

Cloudflare's connectivity cloud protects entire corporate networks, helps customers build Internet-scale applications efficiently, accelerates any website or Internet application, wards off DDoS attacks, keeps hackers at bay, and can help you on your journey to Zero Trust.

Visit 1.1.1.1 from any device to get started with our free app that makes your Internet faster and safer.

To learn more about our mission to help build a better Internet, start here. If you're looking for a new career direction, check out our open positions.

Discuss on Hacker News

DevelopersCloudflare WorkersOpen SourceProduct News

History records the seventeenth-century Battle of Hormuz as one of the biggest naval battles of that era, fought between the dominant powers of Portugal and an Anglo-Dutch alliance. Today’s battle at the Strait of Hormuz, as all observers now know, is at the dominant center of global energy flows. The war with Iran and closure of the strait has, predictably, halted nearly 20 percent of global oil in its tracks, which makes it history’s biggest oil-supply interruption.

For calibration, the Arab oil embargo of 1973–74, triggered by a different Middle East war, resulted in nearly 10 percent of global oil supply being taken off the market for five months. That disruption’s combination of duration and scale eventually led to a tripling of oil prices, a global recession, and in due course, a fusillade of misguided energy policies. If the Strait of Hormuz remains closed long enough, we’ll see similar consequences.

The first energy lesson of this battle should be obvious: oil remains vital to modern civilization. It isn’t just that petroleum is the world’s largest source of energy and most-traded commodity. Oil is essential in the supply chains of everything, from lattes to large language models. It is even critical for building the machines designed to replace oil.

Thus, when oil is expensive, it’s broadly inflationary. Without oil, systems everywhere grind to a halt.

However, advocates of the so-called energy transition are proffering a different lesson. For transitionists, the battle of Hormuz “underscores,” as Microsoft’s global head of energy recently said, the need for renewable energy. We are already hearing loud calls to accelerate or reanimate “quit oil” policies—funding alternative fuels, forcing fuel efficiency or conservation, and even implementing oil rationing or price controls.

There are many uncertainties about how and when the current battle of Hormuz will resolve. But when it comes to the ultimate fallout for energy markets, facts and history point to a different lesson than the transitionists’ “quit oil” nostrums.

The Strait of Hormuz (Photo by Gallo Images/Orbital Horizon/Copernicus Sentinel Data 2025)

Consider the two key results from the more than $10 trillion spent in pursuit of the energy transition over the past two and a half decades. First, per capita global oil use remains unchanged. To be precise, it’s down a statistically irrelevant 2 percent in a world that today has far more people in a far bigger economy. Thus, secondly, total global oil use has risen 30 percent. To put that in context, just the increase in demand is equal to double the European Union’s total oil use.

None of the “quit oil” strategies worked, at least in terms of meaningfully reducing oil demands at any price, never mind at costs economies will tolerate. In short, the world is more dependent on oil now than when the grand and expensive energy-transition experiment began.

At the pinnacle of that experiment, the EV enthusiasms that generated massive subsidies and countless billions of dollars in automotive industry losses resulted in the global automobile fleet having just a 3 percent share that’s all-electric. Even if, one day, one-half of all cars on the planet convert to battery-only propulsion, simple arithmetic shows that this would reduce global oil use by barely 10 percent.

What is the alternative for de-risking economies from the inevitability of another oil price spike in the future? The answer is obvious: economic insulation comes from encouraging greater oil production with greater geographic diversity. And it comes, concurrently, from expanding the size of strategic oil storage, which in turn requires yet more production.

Both strategies entail a philosophy that inverts what policymakers in both Europe and the United States, as well as at the International Energy Agency (IEA), have been fixated on for over two decades. Fortunately for the world’s economies, the momentum is already shifting.

Take, for example, rising development of Argentina’s high-quality shale fields, similarly offshore South America (especially Guyana), and now, perhaps, Venezuela, as well as the offshore production of numerous African nations. Even Canada now seems eager to expand production and exports from its virtually unlimited oil sands.

There are also opportunities to diversify, even rapidly, the delivery paths in the Middle East away from the Strait of Hormuz. How? Build more pipelines to bypass the strait.

At this writing, up to 5 million barrels of oil per day are on track to be re-routed to Saudi Arabia’s 750-mile Petroline pipeline, which will take oil overland away from Persian Gulf ports to one on the Red Sea. The UAE, too, has a 250-mile pipeline that can carry nearly 2 million barrels per day, bypassing the strait. That combination will cover nearly half the trapped crude, but far more is needed, and soon.

History offers an example of how fast long-distance pipelines can be built. In 1942, immediately after the United States entered World War II, American engineers built the Big Inch pipeline from Texas to New Jersey at a rate approaching 10 miles per day. At that pace—which one can imagine modern engineers matching, especially in the EPA-free zone of the Middle East—it could take just a few months to build another 750-mile pipeline, or even two, bypassing the Strait of Hormuz entirely. One hopes that the construction of new Mideast pipelines is already planned, or even underway.

The Big Inch pipeline in 1942 (Photo: Bettmann / Contributor / Bettmann via Getty Images)

Storage, the other time-tested insurance against unexpected commodity interruptions, is a budgetary rather than technological issue. Last year, China announced plans to expand its domestic oil strategic storage to 1 billion barrels—roughly three months’ worth of that nation’s imports. The U.S. strategic reserve peaked at 700 million barrels a decade ago, hovering around that level until the Biden administration sold off about half of it to tamp down oil prices triggered by the combination of the Ukraine war and the inflation-inducing Inflation Reduction Act.

In the face of today’s oil crisis, the IEA and its member states (which includes the United States) announced an unprecedented 400-million-barrel reserve drawdown. While that alone can offset only a few weeks of congestion at the Strait of Hormuz, the pipeline bypass noted earlier will boost that to a few months of cushion. Doubtless, many political leaders and businesses would like a longer runway.

Odds are now high that many policymakers will reprioritize energy security over energy transition. That shift comes at the same time as the resurrection of the primacy of “affordability.” Political momentum, combined with engineering realities and market forces, may finally drain inflated enthusiasms for “quit oil” policies.

Top Photo by Elke Scholiers/Getty Images

The biggest factor holding back an American revolution in science is not money but talent identification. For more than half a century, risk-averse bureaucracies and universities have let bold ideas and promising discoveries wither on the vine under the guise of credentialed expertise and the virtues of peer-reviewed incrementalism.

The evidence for this Great Scientific Stagnation is substantial. Research productivity is declining sharply across many domains. Federal R&D spending is more than 30 times what it was in 1956, and more scientists are trained and more papers published than ever. Yet revolutionary breakthroughs are becoming rarer. Many peer-reviewed findings fail to replicate, and a high probability exists that the vast majority of papers (which no one reads) are full of false conclusions. Accusations of fraud in science are on the rise.

America must break through this chokepoint by focusing on its greatest resource: talent. It matters how, and to whom, we award grants. We should be working toward tapping the energy at the heart of the sun and hanging our achievements in the balance of the stars. Instead, federal science funding has often drifted elsewhere: on promoting insects as human food ($2.5 million), watching monkeys gamble ($3.7 million), observing brain-damaged cats walk on treadmills ($549,000), and sending cash to DEI bird watching clubs ($288,563).

Fortunately, American science may soon get a lot more exciting—faster, wilder, and even more rigorous. On March 2, President Trump nominated Silicon Valley financier Jim O’Neill as director of the National Science Foundation. O’Neill served most recently as Deputy Secretary of Health and Human Services and acting director of the Centers for Disease Control and Prevention.

With a budget of nearly $9 billion, the NSF determines which nonmedical scientists receive funding, which university labs are supported, and which frontiers advance. With O’Neill at the helm, the old slow-drip model of incremental, consensus-driven funding would get a much-needed shake-up.

But O’Neill must first clear the Senate confirmation process, and the opposition is already sharpening its knives. California Representative Zoe Lofgren, the leading Democrat on the House Committee on Science, Space, and Technology, told Science that O’Neill isn’t fit for the office. “[G]iven his track record at HHS and CDC under [HHS Secretary Robert F. Kennedy Jr.], Mr. O’Neill seems like a bad choice to lead the National Science Foundation, our nation’s premier scientific agency.”

Science ran a second article featuring scientists skeptical of O’Neill. Neal Lane, a former NSF director under President Bill Clinton and a physicist at Rice University, said, “I think it’s unfair to ask him to do the job”—largely because O’Neill lacks an advanced science degree. Michael Turner, a cosmologist at the University of Chicago, added that he sees O’Neill and the Trump administration’s direction as overly commercial and “shortsighted.”

Full disclosure: I owe O’Neill a great deal personally. In 2010, he introduced me to Peter Thiel, for whom he then worked as head of the Thiel Foundation and a research lead at his hedge fund. On my first day, September 27, 2010, we launched the Thiel Fellowship, which awarded 20 young people a year $100,000 grants—with two notable conditions: applicants had to be under 19 and agree to drop out of college.

Critics torched the Thiel Fellowship from the start. My favorite was Larry Summers, former president of Harvard, who called our program the “single most misdirected philanthropy of the decade.” Today, however, the fellowship is a strong predictor of future billionaires. Its grantees have generated more than $500 billion in value since the program began. Its hit rate—the share of fellows who start tech companies that reach $1 billion in market cap—exceeds that of top accelerators like Y Combinator and institutions like Harvard Business School.

What I learned running the fellowship with O’Neill, Thiel, and others during its first three years is that America has lost sight of what it takes to produce new inventions and discoveries. That failure has led those who run major institutions to misjudge talent. The people running Harvard or the NSF—the architects of the “Great Scientific Stagnation”—think in terms of buying prestige: the number of papers published, the status of the journals in which they appear, citation counts, the reputations of endorsing professors, prior grants, grant size, university affiliation, and Ph.D. pedigree.

If you’re head of the NSF, responsible for managing more than $10 billion in federal spending to advance science, your goal should be to buy discoveries, not prestige. And to buy discoveries, you need to find and fund creative genius, wherever it turns up.

When I see universities like Johns Hopkins or the University of Pennsylvania collecting billions in grants each year, I see evidence of a flawed understanding of where discoveries come from. True, their scientists produce solid work and, at times, important theories, but are they worth the billions the government sends them? If the “Great Scientific Stagnation” thesis is right—and the evidence suggests it is—the answer is no.

Why aren’t Americans getting a better bang for their science buck? Grant-makers often overlook talent because of perceived flaws: age, appearance, personality, among others. The supposed defects of Thiel Fellows were their youth and lack of a college degree, yet those attributes proved irrelevant. Our job was to predict outcomes and take big risks; the results speak for themselves.

When O’Neill got the nod to lead the NSF, I texted to ask how I could help. “Send me your ideas,” he replied. Here are five.

First, the NSF should adopt the Thiel Fellowship model (or develop its own) for identifying young, overlooked, and therefore undervalued talent. The central challenge is improving selection while relying on less evidence. At the Thiel Fellowship, we built models that assessed the raw character of an engineer or scientist and translated it into an estimate of strengths and likely success.

I emphasize “young” because creativity is perishable. As with athletes, there is a prime age range when the mind is most fecund and sharp. One of American science’s key chokepoints is that institutions don’t trust younger researchers to do great work. The average age of first-time grant recipients is about 40 to 45; that should drop by two decades.

The economist Benjamin Jones’s research, spanning the past century, shows that innovators are reaching their greatest achievements at increasingly older ages. That might be fine if creativity and productivity remained constant over a lifetime—but they do not. Late starts mean shorter careers, resulting, by Jones’s estimate, in a 30 percent decline in the potential for new discoveries and inventions. By analogy, imagine how unimpressive career statistics would be if Major League Baseball barred players from competing until age 30. Albert Einstein was 26 when he wrote the four papers that revolutionized physics in 1905. Isaac Newton was 23 or 24 when he developed calculus and the theory of gravity. The NSF should be looking in these age ranges for tomorrow’s talent.

Second, the NSF must speed up the grant-review process. As it stands, it’s a circus. Multiple studies find that scientists spend 20 percent to 40 percent of their working hours preparing applications that have only about a one-in-five chance of success and take far too long to process. Endless peer-review rituals and elaborate decision procedures, neither of which improve outcomes, slow the pace of discovery.

We should accept a higher risk of flubs, blind alleys, and dead ends in exchange for a better shot at major breakthroughs. Two ideas are worth testing. One is a partial lottery: randomly select from applications that clear a quick initial screen. The other would be scout programs: recruit a rotating network of proven agents—working scientists, professors, independent thinkers—with firsthand knowledge of emerging talent. No interviews or prestige proxies. Give credentials near-zero weight. Scouts would simply select recipients, who wouldn’t even know they were being evaluated until the funding arrived. To avoid entrenched patronage, scouts would serve two-year terms and then pass their authority to a peer outside their immediate professional circle.

Third, measure what matters: the expected magnitude of discovery, not the expected number of citations. Create a “renegade scientist” grant program that explicitly rewards risky, interdisciplinary, even unconventional, proposals that peer review tends to kill. Pair it with a clear list of major unsolved problems that the grants are meant to tackle.

Fourth, use the NSF’s funding and authority to break the cartel of prestigious scientific journals. Taxpayers fund the research, only to have access sold back to them at exorbitant prices. The NSF should use its leverage to free that work from paywalled journals by requiring that all government-funded research be publicly accessible.

Fifth, fix the incentives. Cap or eliminate indirect-cost siphons to universities, especially those with endowments in the tens of billions. Fund people, not buildings. Today, if a university scientist wins a grant, the university claws back more than half of it for “indirect costs” or administrative overhead. This rake-off goes not to the actual business of scientific discovery but to salaries for DEI officers or planting flowers in the quad. The NSF should also require an “idiot index”—a comparison between a scientist’s estimate of an experiment’s cost and the university’s. The aim is to drive spending toward tools and lab space, not bureaucracy.

Do these five things, and the NSF will become the fire for American ingenuity instead of being a steward of stagnation. We have the money and the talent. What’s missing is the courage to stop buying prestige and start buying discoveries.

Jim O’Neill has spent his career proving he can spot that courage in others. Now he should get the shot to institutionalize it. The Senate should confirm him so the next chapter of revolutionary science can begin. As he wrote in an X post announcing his nomination, “Entropy is on the march and China is not waiting.”

Photo: Raquel Natalicchio/Houston Chronicle via Getty Images