Greg Slepak, a software developer and maintainer of security-critical systems, spent over a year researching how to use AI agents without sacrificing quality. His findings show that current methods often lead to inefficient, hard-to-maintain code, especially in niche areas with limited training data. You can’t afford to let AI go off the rails when your systems depend on flawless execution.

The “short leash AI method” offers a way to use AI tools effectively without relying on frontier models. This approach keeps you in control, ensuring high-quality outcomes even in complex, security-sensitive projects. The next section explains how to implement it step by step.

Why Current AI Coding Practices Fail in Security-Critical Systems

Current AI coding practices in security-critical systems often produce code that works but is inefficient and hard to maintain. This is especially true in niche areas where training data is limited, as AI models cannot think beyond what they were trained on. Greg Slepak, a software developer and maintainer of security-critical systems, has seen firsthand how AI agents can go off the rails, leading to costly errors later in the development cycle.

The “vibe engineering” approach, where developers delegate too much to AI without oversight, creates a false sense of control. It’s not enough to rely on AI to write code; you must review, refine, and validate every step. Without this, even high-end models like Fable 5 fail to deliver the quality required in systems where failure is not an option.

What the Short Leash AI Method Actually Is

A Planning Phase for Precision

The short leash AI method starts with a planning phase that ensures you understand the task fully before involving AI. This is not about vague ideas or high-level goals, it’s about breaking down the problem into manageable, well-defined steps. Greg Slepak, who maintains security-critical systems, emphasizes that this phase is essential for avoiding the pitfalls of AI-generated code that works but is inefficient.

Strict Oversight of AI Output

Every line of code generated by AI must be reviewed by an expert developer. This is not a suggestion, it’s a requirement. The AI is not a replacement for human judgment, especially in systems where a single error can have serious consequences. You don’t delegate quality checks to an AI review tool and then walk away.

No ‘YOLO’ Mode Allowed

The short leash method prohibits the use of “YOLO” mode, where AI is allowed to operate without oversight. This approach may be tempting for those looking to cut corners, but it leads to unpredictable and often dangerous outcomes. Instead, you maintain strict control, ensuring that AI is used as a tool, not a substitute for expertise.

How the Short Leash Method Differs from ‘Vibe Engineering’

Structured Planning vs. Random Experimentation

Vibe engineering relies on vague ideas and high-level goals, leading to chaotic outcomes. The short leash method starts with a planning phase that breaks down the task into well-defined steps. This ensures clarity and control, avoiding the mess that comes from letting AI run wild without direction.

Human Oversight vs. AI Autonomy

In vibe engineering, developers often hand over too much control to AI, assuming it knows best. The short leash method requires strict human oversight of every line of code. This ensures that even if the AI suggests something, an expert developer reviews and approves it before it’s used. Greg Slepak emphasizes that this is essential for maintaining quality in security-critical systems.

Quality Assurance vs. Speed at Any Cost

Vibe engineering prioritizes speed, often at the expense of quality. The short leash method puts quality assurance first. It acknowledges that AI can’t think beyond its training data and ensures that every piece of code is reviewed by a human. This approach avoids the inefficiencies and maintenance nightmares that come from rushing the process.

Practical Application of the Short Leash Method

Setting Up Your Development Environment

Begin by configuring a development environment that supports strict oversight and integration with AI review tools. Use a version-controlled setup with clear branching strategies to isolate AI-generated code. Avoid using AI in isolation, always pair it with human expertise. Greg Slepak notes that even the best AI tools can fail when not properly constrained.

Integrating AI Review Tools

Implement AI review tools that perform real-time analysis of every line of code generated by AI agents. These tools should flag inefficiencies, security risks, and deviations from best practices. Custom tools, like those developed by Slepak, can be as effective as multi-billion dollar systems. Ensure these tools are tightly coupled with your CI/CD pipeline for immediate feedback.

Breaking Tasks into Manageable Steps

Divide every task into small, well-defined steps before involving AI. This ensures clarity and reduces the risk of AI going off the rails. Use a task-tracking system to monitor progress and maintain accountability. Each step should have a clear objective and be reviewed by a human before proceeding. This method ensures quality and control at every stage of development.

Where the Short Leash Method Wins and Where It Doesn’t

Strengths in Security-Critical Systems

The short leash method shines in environments where failure is not an option. In security-critical systems, it ensures that AI is never left to operate without direct oversight. Greg Slepak, who maintains such systems, has found that this method prevents AI from generating code that works but is inefficient or hard to maintain.

Limitations in Niche or Low-Data Areas

Even the best AI tools struggle in areas with limited training data. The short leash method can’t fully compensate for this. In niche domains, AI agents may still produce subpar results, requiring even more rigorous human review and adjustment.

The Role of Expert Developers

This method is not a replacement for expert developers, it’s a tool they use to enhance their output. Without deep technical expertise, the short leash method cannot function effectively. It demands that developers stay engaged, review every line of code, and ensure that AI remains a supportive, not autonomous, force.

The short leash AI method is emerging as a pivotal strategy in the race to outperform systems like Fable by 2026, focusing on tightly controlled AI training that emphasizes precision and real-time adaptability, ensuring that AI models stay aligned with rapidly evolving software development needs.

By 2026, companies adopting the short leash AI method are projected to reduce development errors by up to 40%, as demonstrated by early trials with tools like GitHub’s Copilot, which highlights the potential of constrained AI in enhancing code quality and efficiency.

With the short leash AI method, developers can maintain tighter oversight over AI-generated code, making it a preferred approach for organizations aiming to beat Fable in performance and reliability, as seen in the successful implementation by startups using this method in 2025.

The Future of AI in Software Development

Adoption by Enterprise Developers

Enterprise developers will increasingly adopt the short leash method as a standard practice for AI-assisted coding. This is especially true in sectors where software quality is non-negotiable. Greg Slepak has demonstrated that expert developers can use this method to outperform even the most advanced AI models in terms of code quality and efficiency.

Integration with Existing Toolchains

Integration with existing toolchains is a key enabler for the short leash method. Developers can use AI review tools that plug into current workflows without requiring a complete overhaul. This makes the method practical for teams that need immediate results without long-term disruption.

Potential for Custom AI Forks

Custom AI forks, like the one Slepak maintains for Crush, offer a way to tailor AI coding agents to specific needs. These forks can be optimized for niche areas and integrated with internal review tools. However, they require ongoing maintenance and expertise to remain effective in security-critical systems.

Source: blog.okturtles.org