Unveiling the Hidden Blueprints of Artificial Intelligence: What the System Prompts Leaks Repository Reveals About LLM Governance

Every time a user initiates a session with a major large language model (LLM) such as ChatGPT, Claude, Gemini, or specialized coding assistants like Cursor, they are engaging with an interface that has been pre-conditioned by an extensive set of hidden instructions. These "system prompts" serve as the foundational architecture of the AI’s personality, operational constraints, formatting preferences, and safety boundaries. While these instructions remain invisible to the end user, they dictate the logic that governs the interaction. The GitHub repository asgeirtj/system_prompts_leaks has emerged as a comprehensive, crowdsourced archive of these clandestine instructions, offering an unprecedented look at how the world’s most powerful AI models are steered by their creators.

The Mechanics of the System Prompt

To understand the significance of this repository, one must first grasp the technical structure of an LLM request. In the standard OpenAI-style API format, an interaction is divided into distinct roles: the "system" message and the "user" message. The system message acts as a set of immutable standing orders. For example, a developer might instruct a model: "You are a support bot for Acme Inc. Answer only questions about Acme products. Keep answers under 100 words." The model consumes this instruction before processing the user’s subsequent inquiry.

While a simple application might utilize a few sentences to define its purpose, enterprise-grade AI products employ system prompts that can span thousands of words. These documents are complex, multi-layered scripts that encompass persona definitions, intricate formatting rules, definitions of external tools the model is authorized to access, and robust safety policies intended to prevent malicious use or "jailbreaking."

The Anatomy of the Repository

The asgeirtj/system_prompts_leaks repository functions as an organized library of these production-level system prompts. Each entry is stored as a Markdown file, categorized by the specific AI product or company. The collection is more than a mere curiosity; it serves as a historical record of how AI developers have refined their prompting strategies over the past two years.

The repository includes documentation for various industry leaders, though it notably highlights that not all models operate under a visible system prompt. Some entries, such as those for GLM, suggest that certain models may be deployed without a persistent system-level instruction set, leaving the model to rely entirely on its pre-trained knowledge and the immediate user context. This variation underscores the lack of industry standardization in how AI agents are governed at the foundational level. The project is released under the CC0-1.0 license, facilitating open research and academic analysis.

Chronology and Origins of Prompt Extraction

The proliferation of these leaks is a direct consequence of "prompt extraction" techniques—a specialized form of adversarial testing where researchers or users provide carefully crafted inputs designed to trick the model into outputting its own system instructions. Because the system prompt occupies the same context window as the conversation, it is susceptible to "leaks" if the model’s defense mechanisms fail to distinguish between user instructions and the developer’s underlying logic.

The timeline of this phenomenon tracks alongside the mass adoption of LLMs. As models became more capable in late 2023 and throughout 2024, researchers began documenting the specific instructions used to enforce "safety" and "personality." The repository has since become a focal point for researchers, including notable contributions to public discourse such as the Washington Post’s May 2026 interactive feature and data dashboards from the CEPS AI World project in July 2026. These efforts have moved the conversation from niche developer forums into the broader public consciousness.

A Masterclass in Prompt Engineering

For software developers, the repository serves as a practical, free masterclass in professional-grade prompt engineering. Most public tutorials rely on simplified "toy" examples, which fail to address the complexity of production environments. By contrast, the repository allows developers to observe how organizations with massive R&D budgets handle edge cases.

Several patterns emerge upon analysis:

1. Instruction Layering: High-performing prompts use a hierarchical structure, separating identity from task-specific constraints and safety guardrails.
2. Deterministic Formatting: Large-scale models are often instructed to output specific JSON or XML schemas to ensure that the response can be programmatically parsed by downstream systems.
3. Tool-Use Protocols: For agentic workflows—where the AI can trigger functions or browse the web—the system prompts contain highly specific instructions on how to interpret tool outputs and recover from errors.

By comparing their own, often rudimentary, system prompts against these industry-standard benchmarks, developers can identify inconsistencies and improve the reliability of their AI-driven applications.

Architectural Insights into AI Agents

The coding agent category within the repository—covering tools like Cursor, Claude Code, and GitHub Copilot—is particularly revelatory. These prompts disclose how developers wire up AI agents to interact with file systems, run shell commands, and perform iterative debugging. By studying these files, developers gain a mental model of how to build autonomous agents without needing to perform exhaustive reverse engineering. This insight is critical for those looking to implement "agentic" loops, where an AI is given the agency to perform tasks in multiple steps over a prolonged period.

The Security Implications: Why "Secret" is a Misnomer

Perhaps the most vital takeaway from this collection is a sobering lesson in cybersecurity: a system prompt is not a secret. The existence of this repository proves that even the most well-funded AI labs in the world cannot guarantee that their instructions will remain confidential.

For organizations building on top of LLMs, this necessitates a paradigm shift in how they view security. Developers must assume their system prompts will eventually be made public. Consequently, the following practices are now considered industry standard:

• Never encode secrets: API keys, database credentials, or internal URLs must never be placed within the system prompt.
• Avoid sensitive data in prompts: While developers may feel tempted to use the system prompt to "contextualize" user data, doing so risks exposing that data to the model’s output in the event of an extraction attack.
• Enforce security in the backend: Access control must be handled at the database or API layer. The LLM should never be the sole arbiter of what a user is allowed to see. If the backend does not authorize the data, the model should never receive it in its context window.

Comparative Analysis and Vendor Selection

The repository also acts as a vendor comparison tool. By analyzing how different companies handle similar tasks—such as refusing to generate copyrighted material or managing web search results—developers can make informed decisions about which underlying model better fits their specific use cases. One company might prioritize extreme caution and brevity, while another may favor verbosity and creative flexibility. These differences are rarely articulated in marketing brochures but are laid bare in the system prompts.

Exploring the Repository: A Practical Approach

To effectively navigate the vast amount of data within the repository, users are encouraged to employ standard command-line tools to extract meaningful insights. Developers can utilize grep to perform pattern matching across the entire directory, allowing them to isolate how different vendors address specific challenges like "tool usage," "markdown formatting," or "security policies."

For example, a search command can quickly reveal how many models include explicit instructions to avoid specific programming languages or to prioritize certain library functions, providing a high-level view of the "opinionated" nature of various AI assistants.

Implications for the Future of AI Governance

The existence of this repository signals a new era of transparency in the AI ecosystem. As these models become more deeply integrated into the fabric of the digital economy, the "black box" nature of their instructions will continue to face scrutiny. While companies may attempt to patch vulnerabilities that allow for prompt extraction, the fundamental architecture of the transformer model suggests that as long as instructions and data share the same context window, the potential for leakage will persist.

The industry is moving toward a model of "security through transparency," where developers acknowledge that the instructions guiding an AI are part of its public behavior rather than its private source code. As this collection continues to grow, it will likely serve as an essential resource for academics, security auditors, and developers alike, ensuring that the next generation of AI agents is built with more robust, transparent, and secure architectures. For the developer, the lesson is clear: build with the expectation of visibility, and ensure that the intelligence of your system resides in its backend, not in the fragility of its instructions.