Key Takeaways

  • Ahmad Nassri, CTO of Socket and former CTO of npm, strips out automated agent skills and treats models strictly as research assistants and fast typists.
  • Blindly merging agent-generated code destroys the engineer's mental model of the system, creating invisible technical debt that compounds during production outages.
  • Open-source supply chain security risks are accelerating, with time-to-exploit dropping to hours and autonomous agents hallucinating unverified dependencies.
  • Nassri keeps his prompts tiny, isolates repository discovery, and reads every line before committing using Ahmad Nassri's 4-Step AI-Assisted Development Workflow.

The Ahmad Nassri 4-Step AI-Assisted Development Workflow

Nassri refuses to hand the steering wheel to autonomous software agents. To maintain total control over his codebases while shipping quickly, he uses a four-part method:

Step 1: Strip Agent Skills and Constrain Prompt Scope

Remove third-party agent tool integrations and strictly limit prompt scope. As Nassri explains: “As many skills that you have in your machine, which nowadays I basically don't have any more skills on my agents, I just removed them all. And I try to keep my scope as small as possible what I'm prompting the machine to do or the agent to do.” (play from 1:51:19)

Step 2: Outsource Code Discovery and Telemetry Research

Use the agent to scan repositories and collect context across projects instead of writing architecture blindly. Nassri uses AI for “research and discovery, and collecting information across multiple repos, and find me the code path for this or get the telemetry from that and do some correlation for me so that I can spend less time clicking around and finding the information.” (play from 1:51:58)

Step 3: Dictate System Architecture and Accelerate Typing

Decide every structural choice, function signature, and behavior yourself before asking the model to write code. Nassri notes that he expects the model to “either type faster than me because I've already made up my mind about what the shape of the structure of the code should be and what the behavior of the function should be, and I'm just telling it how to do it and what to type for me... scope down as much of the change to small bits and bytes as possible.” (play from 1:51:46)

Step 4: Mandatory Human Line-by-Line Code Review

Never commit a pull request until you have personally inspected every line. Nassri warns against passive approval: “I still read all the code before I commit it... If I didn't learn what the code was doing before, I'm going to cause myself more pain and trouble than just blindly prompting the thing.” (play from 1:50:18)

When This Works (and When It Doesn't)

This method shines when building critical infrastructure, payment pipelines, and security-sensitive backend services. At Socket, Nassri deals with package registries where malicious actors deploy automated worms like Shai-Hulud within hours of an exploit. If your codebase touches authentication or external network requests, unverified agent code is an open invitation for hallucinated dependencies and malicious imports. A developer who does not understand the exact control flow cannot debug a failure when production breaks at midnight.

It breaks down when you are building disposable prototypes or throwaway marketing pages. If you are validating customer demand for a weekend hackathon project, spending forty minutes verifying variable names and loop constructs slows you down without protecting core assets. When code survival is measured in days, raw speed beats deep comprehension. But the moment code enters a production repository, Nassri's caution becomes necessary.

What to Do With This

Take your core repository today and open your AI configuration. Disable automated file creation tools and background shell execution plugins. The next time you need to build a new database migration or background worker, do not tell the agent to build the entire feature from a product description. Instead, map out the function signatures, error types, and table schemas on paper first.

Feed the model the exact interface you designed. Tell it to implement only the internal logic of a single function. When it generates the fifty lines of code, read every loop, every type assertion, and every error branch before staging the file. If you see a method you cannot explain without running the test suite, delete it and rewrite it yourself.