System Prompts Leaks GitHub Explained: What AI Agent Prompts Reveal

📋 Overview

Alex Hitt walks through one of the most significant open-source intelligence resources in AI: the system_prompts_leaks GitHub repository. Maintained by developer asgeirtj in Iceland, this archive has become the definitive catalog of internal system prompts from commercial AI systems — the hidden instruction sets that govern how models like Claude, GPT, Gemini, and Copilot actually behave. With over 43,600 stars, it has transformed the study of AI behavioral conditioning from speculation into verifiable software engineering.

🏗️ Context and Setup ▶ 0:00

The video opens by contextualizing the sheer scale and significance of the system_prompts_leaks repository. With over 43,600 stars and 7,200+ forks, this project has quietly become one of the most consequential repositories on GitHub — not for code it ships, but for the proprietary documents it curates.

These documents are system prompts: the foundational instruction sets that AI companies embed at the beginning of every conversation. They define the model's persona, its operational constraints, its tool access permissions, its code execution capabilities, and its safety guardrails. These prompts shape every interaction for billions of daily users across platforms like ChatGPT, Claude, Gemini, and Copilot.

What's in the Archive

• Anthropic Claude Fable 5 — The latest Claude model's full operating instructions
• Google Jules — Google's autonomous coding agent with specialized developer-environment prompts
• OpenAI GPT-5.5 Thinking — OpenAI's reasoning-enhanced model instructions
• Microsoft Copilot CLI — Copilot's terminal-based agent prompt
• Cursor IDE Agent — The AI coding assistant's complete system prompt

What makes this repository transformative is the paradigm shift it represents. Previously, understanding how commercial AI systems were instructed required reverse engineering through behavioral observation — essentially guessing at the rules by watching the outputs. Now, researchers can read the actual source documents, comparing instructions across vendors, tracking changes over time, and verifying claims about AI safety measures directly.

🔍 Why System Prompts Leaks Matters ▶ 0:48

The most critical challenge with any leaked document is authenticity verification. Since large language models can generate plausible-sounding text, how can researchers be certain these prompts are genuine exfiltrations and not sophisticated hallucinations? Alex outlines three rigorous verification methods that the community relies on.

1. Internet Convergence

Independent researchers operating across completely separate networks, platforms, and geographic regions routinely extract the exact same 3,000-word strings. When dozens of uncoordinated people, using different accounts and different extraction techniques, all recover identical text — character for character — the probability of fabrication drops to near zero. This is the "wisdom of the crowd" applied to reverse engineering.

2. Negative Testing

Researchers inject deliberately fabricated rules into a genuine prompt fragment and present it to the model. Authentic models reject the fabricated portions while verifying the legitimate elements. This proves the model is cross-referencing against a static internal document — it can distinguish between its real instructions and invented ones. If the prompt were hallucinated, the model would have no basis for accepting some parts and rejecting others.

3. Statistical Reproducibility

The gold standard of verification. Extractions are validated when the exact same output is derived consistently across hundreds of independent generations, each initiated in a completely fresh, zero-context window. Given the probabilistic nature of LLMs — where each token is sampled from a probability distribution — the mathematical probability of a model spontaneously hallucinating the same highly structured, multi-thousand-word document across multiple zero-context sessions is virtually zero.

🏛️ The Four-Layer Architecture ▶ 1:37

One of the video's most illuminating contributions is the identification of a universal four-layer taxonomy that appears across all enterprise AI models. These system prompts aren't casual instructions — they function as rigid pseudo-code operating systems with a clear hierarchical structure.

The Four Pillars

1. Identity Pillar (Innermost) — Anchors the model to a specific temporal reality. This layer tells the model its name, its knowledge cutoff date, and the current date. It prevents temporal hallucinations — situations where a model might claim it's 2023 when it's actually 2026, or reference events that haven't happened yet. This grounding layer ensures every subsequent instruction operates within a coherent reality.
2. Core Capabilities Pillar — Defines what the model can do: tool access, code execution, file I/O, web browsing, image generation. This layer manages computational efficiency and thread execution (explored in the next section).
3. Operational Constraints Pillar — Specifies behavioral boundaries: formatting rules, response length guidelines, conversation flow patterns. This is where the model learns how to structure its outputs for the target UI.
4. Safety Pillar (Outermost) — The overriding guardrail against adversarial inputs. This layer contains content policies, refusal conditions, and escalation protocols. It wraps everything else, functioning as the last line of defense.

Anthropic's Hidden IP Reminder

A particularly revealing finding is Anthropic's automated IP reminder mechanism. Built into the system prompt, this instruction explicitly forbids the model from reproducing:

• Song lyrics
• Sections of copyrighted books
• Long excerpts from periodicals

Even when users present adversarial workarounds designed to bypass this restriction, the prompt-level instruction takes precedence. Most striking: the prompt explicitly commands the model to hide the existence of this reminder from the human operator. Users are never told that a copyright compliance layer is silently filtering their requests — they simply receive a refusal or a paraphrased alternative.

⚙️ Thread Execution & Tool Orchestration ▶ 2:25

Within the core capabilities pillar, system prompts contain surprisingly sophisticated instructions for computational workflow management. The Microsoft Copilot CLI prompt provides a clear example of how natural language instructions directly manage execution logic.

The Tool Call Flowchart

The Copilot CLI system prompt includes what amounts to an algorithmic flowchart expressed in natural language:

1. Receive a multi-step task request
2. Evaluate task independence: Are the requested operations independent of each other?
3. If independent → Execute in parallel to maximize efficiency and minimize latency
4. If data dependency exists → Execute sequentially to prevent failures from missing inputs

This is a direct mapping of traditional algorithmic flowcharting onto natural language prompt engineering. The model is being given instructions that would normally be expressed as code — dependency graphs, execution ordering, concurrency management — but written entirely in English prose.

Why This Matters

The implications are significant for software engineering as a discipline. Natural language instructions in these prompts are actively:

• Managing thread execution — deciding what runs concurrently vs. sequentially
• Preventing race conditions — ensuring data dependencies are respected
• Optimizing throughput — maximizing parallelism where safely possible

🧩 Solving Context Fragmentation ▶ 3:14

One of the most practical engineering challenges revealed in these prompts is context fragmentation: the tendency for AI agents to lose track of their progress when holding complex multi-step tasks entirely in internal memory. The model starts a five-step workflow, completes steps 1-3, then loses its place and either repeats work or skips ahead.

Claude Desktop's Kanban Solution

Anthropic's Claude Desktop prompt solves this with a to-do write tool that commands the model to build a structured task board directly inside the context window:

• Pending — tasks queued for execution
• In Progress — the currently active task
• Completed — finished tasks with results

The critical innovation is an engineered bottleneck: the prompt strictly caps the in-progress state to one concurrent task. This hard-coded limit forces linear subroutine completion — the model must finish researching a topic before it's allowed to begin designing the solution. This mirrors the single-WIP-limit principle from Kanban methodology in agile software development.

Microsoft's SQL Approach

Microsoft's Copilot CLI uses a parallel strategy, instructing the model to reflect its tasks and dependencies into a queryable SQL database for tracking. Rather than a visual board, the model maintains a structured relational model of its workflow — tasks, dependencies, statuses — that it can query to determine what to do next.

🛡️ Defensive Engineering Guardrails ▶ 4:02

When AI agents operate autonomously in local developer environments — with access to file systems, package managers, and version control — the potential for accidental damage is enormous. The leaked prompts reveal the defensive engineering patterns that vendors use to constrain these agents.

Google Jules: Verification-First Mindset

The Google Jules prompt mandates a diagnosis-before-action approach when the agent encounters errors. Specifically:

• Prohibits reactive package installs/uninstalls — Jules cannot respond to an error by immediately running pip install or npm install
• Requires root cause diagnosis — The model must read error logs, examine configuration files, and understand the failure before altering the environment
• Only after diagnosis confirms a missing dependency is the model permitted to install it

Cursor IDE: Absolute Path Enforcement

The Cursor IDE agent operates under strict rules for file system navigation:

• Before using any tool, the agent must construct a mathematically absolute file path
• User-provided relative paths must be resolved against the project root
• This prevents directory traversal errors — situations where the agent accidentally reads or writes to files outside the project scope

OpenAI Codex: Scope Creep Prevention

OpenAI's Codex prompt contains an explicit warning: "Do not fix unrelated bugs." When the model encounters a bug that isn't related to the user's request, it must ignore it. This constraint prevents scope creep — a common failure mode where AI agents start "improving" code they weren't asked to touch, introducing unexpected changes and breaking unrelated functionality.

🎨 UI Formatting & Output Constraints ▶ 4:50

A surprising finding from the leaked prompts is the massive token budget dedicated purely to structural formatting. A significant portion of every system prompt — sometimes hundreds or thousands of tokens — exists solely to bridge the gap between raw LLM output and a functional user interface.

Anthropic's XML Tagging Strategy

Anthropic uses XML tagging to physically separate different categories of instructions within the prompt. Overarching behavioral directives are enclosed in high-level XML tags, creating a structural boundary between the model's foundational operating rules and volatile user-provided inputs. This separation prevents prompt injection attacks from "bleeding" user content into system-level instructions.

Error Handling via Try-Catch Logic

Models are instructed to implement internal try-catch logic blocks when handling data from external APIs. When an API returns malformed JSON, unexpected data types, or missing fields, the model is told to fall back to raw text processing rather than crashing the execution loop. This mirrors defensive programming practices in traditional software:

// Pseudo-logic embedded in natural language prompts:
// Try: Parse API response as structured JSON
// Catch: Fall back to raw text extraction
// Never: Crash the conversation or return an error to the user

Codex's Citation Marker Prohibition

OpenAI's Codex prompt contains a strict prohibition: never output internal citation markers (like 【13†source】) that the command-line interface cannot render. Instead, the model must output standard file paths that the CLI software can convert into clickable hyperlinks. This seemingly minor formatting rule exists because the model's natural output format was designed for ChatGPT's web UI — the CLI needs entirely different output conventions.

🎯 Key Lessons & Final Takeaways ▶ 6:27

Alex closes with a strategic assessment of what the system_prompts_leaks repository means for the AI industry at large.

Prompt Exfiltration Is Inevitable

Researchers consistently extract operating instructions from even the most advanced models. Despite vendors' efforts to prevent system prompt leakage — including instructions within the prompt itself telling models not to reveal their instructions — exfiltration has become functionally inevitable. The attack surface is simply too large: with billions of queries per day, adversarial extraction techniques will always find a way through.

Prompt Obfuscation Is a Dead Strategy

For any company relying on prompt secrecy as a competitive moat, the message is clear: this strategy is dead. The blueprints for AI operating systems are now public, versioned, and diff-able. Competitors can study exactly how rivals structure their prompts, what safety measures they implement, and what capabilities they expose.

Where the Real Moat Lives

Enterprise AI laboratories are pivoting their engineering focus toward advantages that can't be exfiltrated:

• Neural weight optimization — The model's trained parameters represent billions of dollars of compute investment. Unlike prompts, these can't be extracted through conversation.
• API orchestration speed — Infrastructure-level advantages in latency, throughput, and reliability. How fast you can serve results matters more than what instructions you prepend.
• Training data quality and scale — The curation, licensing, and processing of training corpora remain proprietary and non-extractable.

💎 Key Takeaways

1. System prompts are operating systems: They implement a universal four-layer architecture (identity → capabilities → constraints → safety) that functions as pseudo-code, not casual instructions.
2. Verification is rigorous: Internet convergence, negative testing, and statistical reproducibility across zero-context sessions confirm these are static, hard-coded documents — not hallucinations.
3. Natural language is the new control plane: Prompts now manage thread execution, dependency resolution, and race condition prevention — traditional software engineering concerns expressed in English prose.
4. Memory externalization enables autonomy: Kanban boards, SQL databases, and structured task tracking in the context window solve the context fragmentation problem that cripples long-running agents.
5. Defensive engineering is embedded: Leading agents are programmed with verification-first mindsets — diagnosis before action, absolute paths over relative, and strict scope boundaries.
6. Formatting consumes enormous token budgets: UI compatibility layers, XML structural tagging, and output standardization rules represent a surprisingly large portion of every system prompt.
7. Prompt secrecy is over: Exfiltration is functionally inevitable. The real competitive moat has shifted to neural weights, infrastructure speed, and training data quality.

⏱ Timestamp Index

🔗 Resources & Links