Y Combinator's most valuable asset isn't the money it provides or even the mentorship; it's the credential itself. When founders tell investors they're "YC-backed," doors open. Enterprise customers ease up on vetting. Other founders offer trust they'd never give a stranger. But that credential only works if people believe it screens for something real. This year, two portfolio companies have tested that belief in very public ways.

What Happened With Delve and Why It Matters?

Delve looked like a model YC company on paper. Two 21-year-old MIT dropouts, Karun Kaushik and Selin Kocalar, founded it in late 2023 with an ambitious pitch: use artificial intelligence to compress months of compliance work for SOC 2, HIPAA, ISO 27001, and GDPR certifications into days. The company emerged from YC's W24 batch with a $300 million valuation, backing from Insight Partners, and more than 1,000 paying customers.

In March 2026, an anonymous writer using the name DeepDelver published a detailed investigation titled "Delve: Fake Compliance as a Service (Part I)." The post alleged that Delve produced fake evidence, wrote auditor conclusions for certification mills that rubber-stamped reports, and skipped major framework requirements while telling clients they were fully compliant. The leaked reports were difficult to dismiss. ComplianceHub analyzed 259 Type II SOC 2 reports from the leaked dataset and found that all of them claimed zero security incidents, zero personnel changes, and zero cyber incidents, with identical "unable to test" conclusions across the same control categories.

A later installment brought the allegations inside YC's own walls. DeepDelver alleged that Delve had forked an open-source agent-building tool from fellow YC company Sim.ai and repackaged it as its own Pathways product, after the Sim Studio team had paid Delve $15,000 for compliance work. YC acted within days. Around April 3, the accelerator removed Delve from its company directory and asked the founders to leave. Garry Tan, YC's CEO, reportedly wrote on Bookface, YC's internal forum, that "YC is a community, not just an accelerator".

Garry Tan, YC's CEO, reportedly

Delve has denied wrongdoing. Kaushik said the company "grew too fast and fell short" but rejected the fraud claims, blaming a targeted cyberattack and saying the whistleblower's data had been manipulated or taken out of context. For YC, the damage extends beyond one company. Critics pointed out that Delve concentrated on selling to other YC companies who trusted the YC brand. The network founders give up equity to join is the same thing that made Delve's sales pitch work. YC's handling of the exit didn't help either. One widely read essay noted that Delve disappeared from YC's directory with no press release or public statement, and argued it was expelled for stealing from a fellow YC company rather than for anything it did to customers.

Kaushik

How Is Corgi Creating a Different Kind of Problem?

Corgi presents a different challenge. Nobody has accused it of fraud, and by most measures the business is working. It's a San Francisco insurtech that operates as a licensed carrier for tech startups, and as of June 2026 it was valued at $2.6 billion. What draws attention is how the company behaves, and how much of that happens in YC's backyard. In February, Corgi opened a 24-hour café at its San Francisco headquarters with a discount for YC alumni, and in April it started free bus routes around YC's offices.

In June, Papermark co-founder Marc Seitz went after Corgi on X, accusing it of taking Papermark's open-source and enterprise-licensed code for its new Dataroom product. He added that it "makes the rest of your business questionable and the YC community look terrible." Corgi's founder Laqua initially replied that his team had told him they used none of Papermark's code and promised a code audit with results posted on Corgi's website. He followed up with a code comparison, admitting the team should have relied more on its own language and visual choices, and suggesting Seitz was upset because Corgi's product was mostly free and competed with his. X users attached a Community Note to that post claiming Corgi's Dataroom shared identical variable names, code structure, and UI text with Papermark.

The controversy expanded. The founder of Hello World Cafe, which competes with Corgi's coffee business, said he received a cease-and-desist from Corgi's lawyers over a tweet joking about the controversy. The company had also sued several former employees, and Laqua went viral after telling Harry Stebbings' podcast he expects staff to work seven days a week. Corgi sent Seitz a cease-and-desist too, demanding he take down his post.

What's the Broader Pattern Here?

The latest round of scrutiny started when Insurance Business reported that a Corgi marketing employee, in a since-deleted X post, named the company's hands-off speech policy as a reason she joined, contrasting it with a previous employer that had asked her to delete a comment containing a disability-related slur. That set off wider scrutiny of Corgi's social media strategy and the group of young female employees known online as the "Corgi Girls." Laqua refused to budge. To people pressing him to fire staff over their posts, he wrote that "it's not going to happen," and argued companies would aim higher if employees could speak freely instead of producing what he called "corporate slop".

YC hasn't said anything publicly about Corgi. Corgi disputes the copying claims and runs a licensed insurance business with paying customers. The optics are still bad for YC. A company that leans this hard on its YC ties, down to cheaper coffee for alumni, brings some of the YC name along into every fight it picks online.

Either story alone would fade. Together they sit on top of older ones. In 2024, YC took heat for backing PearAI, whose founder openly described the product as a clone of VSCode and another AI editor called Continue, and Tan defended the company on X. Tan's own posting adds to it. After he bragged in March about how much AI-generated code he was shipping, Fast Company reported that a developer went through his blog and found bloat, waste, and rookie mistakes.

How Can YC Rebuild Trust in Its Brand?

• Clarify Public Standards: YC could explain publicly what its name is meant to guarantee and what gets a company removed from the directory, rather than letting anonymous Substack writers and rival founders on X decide what "YC-backed" means.
• Set Expectations for Portfolio Companies: The accelerator could establish clear guidelines about how portfolio companies should represent the network once they've graduated, without policing individual posts or speech.
• Communicate Credential Value: YC could reinforce what the credential actually screens for, since a credential only works if people believe it screens for something real and meaningful.

What connects these cases is a culture that rewards moving fast and posting loudly. Delve sold certifications on a timeline that real audits struggle to match. Corgi launched a product with on-screen text close enough to a competitor's that it had to change it, then sent legal letters to critics. YC's own leadership talks the same way online, which makes it hard for the firm to seem surprised when a portfolio company follows suit.

It's not yet a full crisis. YC still draws the strongest applicant pool in startups, and Demo Day still pulls in every investor who matters. One expulsion and one combative portfolio company won't erase two decades of backing Airbnb and Stripe. The risk is slower than that. A credential only works if people believe it screens for something. Delve raised doubts about the screening. Corgi raises a separate question about whether YC has any say in how its companies represent the network once they've graduated. By staying quiet on both, YC leaves the explaining to other people.