What Is a System Prompt? 430 Real Ones, Captured From Every Major AI

A system prompt is a block of instructions a language model reads before it ever sees your message. It sets the rules: who the model is, what it may refuse, how it should format answers, which tools it can call, and what it must never say.

You do not write it and you are not shown it. By the time you type "hello", the model has already read several thousand words telling it how to behave.

Every product built on an LLM has one. ChatGPT has one. Claude has one. Gemini, Grok, Cursor, Perplexity, Copilot — all of them. They are the single largest reason two products built on the same underlying model behave completely differently.

The repo `asgeirtj/system_prompts_leaks` collects them. At the time of writing it holds 430 markdown files and has 65,692 stars with 10,774 forks — placing it in the top tier of GitHub repositories by raw popularity, which for a collection of text files is remarkable.

The Washington Post built an interactive story on it. A CEPS research dashboard runs off the same files. This is not a curiosity repo; it has become the reference corpus people cite when they write about how AI products are actually configured.

This is the most common point of confusion, and the distinction is simple once you see it.

The usual analogy is a job description versus a task. The system prompt is the standing brief — "you are a careful assistant, you refuse these categories, you format code like this, you have these tools". The user prompt is the individual request — "fix this function".

There is a third layer people forget: the developer or API prompt. If you are building on the OpenAI or Claude API, the system prompt is the one you write. The leaked files in this repo are the system prompts of the consumer products — what Anthropic sends for claude.ai, what OpenAI sends for ChatGPT. Your API calls do not include them.

Models are also trained to weight these differently. Instructions in the system prompt carry more authority than the same words typed by a user, which is precisely why "ignore your previous instructions" usually fails. Much of the safety engineering in modern LLMs is about maintaining that hierarchy under pressure.

430 markdown files, organised by vendor. The distribution is lopsided:

Anthropic dominates not because Claude leaks more, but because the repo captures every variant separately — Claude Code across several models, Claude Design with its tools and skills, Claude Cowork, Claude Science, plus the web and mobile prompts.

For scale, here is what the captured prompts weigh:

Claude's captured prompt is roughly the length of a short novel. It is read in full before every single conversation.

Here is the part worth dwelling on, and the reason this repo is more interesting than a simple leak.

Anthropic publishes its Claude system prompts. They are in the official release notes, openly, on purpose. The repo stores those too, in an Anthropic/official/ folder — so you can put the published version side by side with the captured one.

They are not the same size:

• Official, published by Anthropic: 4,269 words
• Captured from the running product: 56,148 words

That is roughly 13 times larger. So what is in the other 52,000 words?

The published version contains exactly one top-level section: claude_behavior — product information, refusal handling, child safety, legal and financial advice, tone, formatting, user wellbeing, evenhandedness, knowledge cutoff.

The captured version contains that same section, plus fifteen more:

memory_filesystem · end_conversation_tool_info · persistent_storage_for_artifacts · mcp_app_suggestions · suggest_catalog_plugins_and_skills · past_chats_tools · preferences_info · computer_use · request_evaluation_checklist · when_to_use_visualizer_for_inline_visuals · search_instructions · Tools · anthropic_api_in_artifacts · available_skills · network_configuration

The single largest block is `Tools`, running about 5,400 lines on its own — the full definitions of every tool the model can call.

Is this a cover-up? No, and it is worth being fair about it. Tool definitions are not really "the system prompt" in the sense most people mean. They are API schemas, injected by the harness, and they change per surface. Anthropic publishes the behavioural policy because that is the part that describes how Claude is meant to act.

But the gap is still the most useful thing in this repo. What a company publishes is its stated policy. What the model actually receives is policy plus the entire operational scaffolding — memory rules, privacy constraints on what may be stored, search behaviour, tool contracts. If you want to understand why an assistant behaves a certain way, the published version will not tell you. The captured one might.

Read enough of these and patterns emerge across vendors that no marketing page would state.

Enormous effort goes into tone, not capability. Large fractions of every prompt are spent on how to sound — do not open with flattery, do not pad with caveats, do not moralise, vary sentence length. Model providers evidently consider default LLM voice a serious product problem.

Refusals are far more specific than the public policies. Published safety policies are broad. The prompts contain concrete, enumerated categories with worked examples of what to do at the boundary.

Formatting rules are unexpectedly detailed. When to use a bulleted list, when prose is better, when to use a table, how much code to show. Much of what feels like "the model's style" is an explicit instruction.

Uncertainty is engineered. Prompts include instructions about how to behave when the model does not know, how to treat its knowledge cutoff, and how to avoid asserting things it cannot verify.

Memory and privacy rules are strict. Claude's captured prompt contains explicit blocks — protected_attributes, sensitive_information, never_store, forbidden_memory_phrases — governing what may be written to memory about a user. Considerably more careful than most people assume.

If you write prompts for a living, this corpus is the best available textbook. These are instruction sets refined by well-resourced teams against millions of real conversations. The patterns in them are worth more than most prompt-engineering courses.

The repo says the prompts are "captured verbatim". Treat that with appropriate care.

System prompts are typically extracted by asking the model to repeat its instructions, through various framings that get past the refusal to do so. This works because the prompt is genuinely in the model's context — it can read it back.

The problem is that a language model reproducing text from its context is not a guaranteed-faithful copy. It can paraphrase. It can skip. It can smooth over a section. It can, in the worst case, generate plausible-looking text that was never there. Nothing in the extraction process distinguishes an exact quotation from a confident reconstruction.

So the honest position is this:

• Structure and substance are very likely accurate. Multiple people extracting independently, across time, converging on the same sections is strong evidence.
• Exact wording may not be exact. Do not quote a single line as definitive fact about a company's policy.
• Files can go stale quickly. These prompts change constantly. A file dated two months ago may describe a version that no longer exists.
• Anthropic's official folder is the exception. Those are published by the company, so they are authoritative — and they are the only files in the repo that are.

The repo does not include verification metadata — no capture method, no model version confirmation, no reproduction count. That is the main thing separating it from a rigorous research artefact. Use it as a very good map, not as a legal document.

Two separate questions, and the repo gets one of them awkwardly wrong.

Is extracting a system prompt illegal? Almost certainly not in itself. You are asking a product you have legitimate access to what its instructions are, and it tells you. No system is broken into. Some providers' terms of service prohibit attempting to reveal the prompt, so it may breach terms — which is a contractual matter, not a criminal one, and the usual consequence is a ban.

Is redistributing it a copyright issue? Murkier. A long, carefully-written system prompt is a creative text work, and the company that wrote it holds copyright. Reproducing it wholesale is not obviously fair use, though the argument for commentary, research and journalism is real — and the Washington Post's use suggests publishers are comfortable treating it as reportable.

Which makes the repo's licence choice genuinely odd. It is released under CC0-1.0, a public domain dedication. But you cannot CC0 work you do not own. The maintainer is dedicating to the public domain a collection of text written by Anthropic, OpenAI, Google and xAI. Whatever the legal status of the underlying files, that licence cannot be correct as applied to them.

In practice nobody appears to be litigating. Anthropic publishes its own prompts anyway. No takedown has hit a repo with 65,000 stars in plain sight. But if you are thinking of shipping these files inside a commercial product because "it is CC0", that reasoning does not hold. Read them, learn from them, and write your own.

Read it if you build with LLMs. If you are writing a system prompt for your own product, this is the closest thing to seeing how the best-funded teams in the industry solve the same problem. The formatting rules alone will improve your output.

Read it if you are researching AI safety or policy. The distance between published policy and shipped instructions is measurable here, which is unusual and useful.

Read it if you are simply curious why ChatGPT and Claude feel different despite doing the same job. The answer is largely in these files.

Skip it if you want a prompt library to copy from. That is not what this is. These prompts are tightly coupled to their own products — their tools, their harnesses, their models. Lifting Claude's prompt into your app produces something confused, not something good.

Be careful if you plan to cite it. Everything except the Anthropic/official/ folder is community-extracted, unverified, and possibly stale. Quote it as "reportedly" and date your reference.

Everything above was checked against the repository on 13 September 2026, when it stood at 65,692 stars and 430 prompt files. Both numbers move quickly.