Every time you open ChatGPT, Claude, Gemini, or an AI coding tool like Cursor, the model has already read a long set of instructions before your first message arrives. You never see those instructions, but they shape almost everything about how the assistant behaves: its tone, its formatting habits, which tools it reaches for, and what it refuses to do.
The GitHub repository asgeirtj/system_prompts_leaks collects those hidden instructions in one place.
This article explains what the repo is, how it is organized, and, most importantly, what you as a developer can take away from it.
If you have used an LLM API, you have already written one. A chat request is usually split into roles. The system message sets the rules, and the user messages are the conversation.
Here is a minimal example using the OpenAI-style message format:
const messages = [
{
role: "system",
content: "You are a support bot for Acme Inc. Answer only questions about Acme products. Keep answers under 100 words."
},
{
role: "user",
content: "How do I reset my password?"
}
];
The end user only sees the second message and the reply. The first message is invisible to them, but it steers the whole response.
Commercial products do exactly the same thing, just at a much bigger scale. Instead of two sentences, their system prompts can run to thousands of words covering personality, formatting rules, tool definitions, safety policies, and product-specific behavior.
The repo is a large, organized collection of these production system prompts, captured from real products. Each prompt is stored as a Markdown file, grouped into folders by company.
The main folders include:
There is also an interesting note in the GLM folder: the maintainer documents that GLM appears to serve no system prompt at all, which is a useful data point in itself.
The README has a "Recently Updated" table at the top, so it is easy to see which products have fresh captures. The repo is released under the CC0-1.0 license.
It has also been picked up outside the developer world. The README points to a Washington Post interactive piece (May 2026) and a data dashboard from CEPS' AI World project (July 2026), both built on files from the repo.
Mostly through prompt extraction: asking the model, in one way or another, to repeat the text it was given before the conversation started. The banner image on the repo shows exactly this kind of request.
This works because a system prompt is just text sitting in the model's context window. The model can read it, so with the right phrasing it can often be convinced to write it back out.
A few caveats worth keeping in mind:
You do not need to be building a chatbot to get value from this repo. Here are the practical lessons.
Most prompt engineering tutorials show short, toy examples. These files show how teams with large budgets actually structure instructions that serve millions of users.
When you read through a few of them, patterns jump out:
If your own system prompt is three lines long and your app behaves inconsistently, comparing it against these files is a quick way to see what you are missing.
The coding agent prompts (Claude Code, Codex, Copilot agent, Cursor, Gemini CLI) are especially useful if you are building agentic workflows. They show how vendors:
Reading two or three of these side by side gives you a good mental model of how modern AI agents are designed, without having to reverse-engineer them yourself.
Ever wondered why an assistant keeps avoiding bullet points, insists on searching the web for a simple question, or refuses to reproduce song lyrics? The answer is often sitting right in the system prompt.
Knowing this helps you debug your own integrations. If you use a consumer app and the API and notice they behave differently, the system prompt is usually the reason. The API gives you a much cleaner slate.
This is the most important takeaway. If the largest AI companies in the world cannot keep their system prompts private, your app will not be able to either.
Treat your system prompt as public by default. That means:
Do NOT put in a system prompt:
- API keys, tokens, or passwords
- Internal URLs or database connection strings
- Private customer data
- Business logic you would be embarrassed to see on GitHub
And do not rely on the prompt as your only security boundary:
// Bad: trusting the prompt to enforce access control
const systemPrompt = "Never reveal other users' orders.";
// Better: enforce it in your backend before data reaches the model
const orders = await db.orders.findMany({
where: { userId: session.user.id } // the model never sees other users' data
});
The rule of thumb: the model should only ever have access to data the current user is already allowed to see. If a clever user extracts or bypasses the prompt, nothing sensitive should leak.
Because so many products are in one place, you can compare how different companies approach the same problem, such as how they format answers, how cautious they are, or how they describe web search. That is useful context when choosing a model or provider for your project.
The repo is large, so here is a practical way in:
git clone https://github.com/asgeirtj/system_prompts_leaks.git
cd system_prompts_leaks
grep -ril "tool" --include="*.md" . | head -20
grep -ri "markdown" --include="*.md" . | less