{"slug": "what-ai-chatbots-are-told-before-you-type-a-developer-s-guide-to-the-system", "title": "What AI Chatbots Are Told Before You Type: A Developer's Guide to the system_prompts", "summary": "A GitHub repository, asgeirtj/system_prompts_leaks, collects the hidden system prompts used by production AI products including ChatGPT, Claude, Gemini, Cursor, and Claude Code, organized as Markdown files grouped by company. The collection documents how vendors structure instructions for personality, formatting, tool use, and safety, and notes that GLM appears to serve no system prompt at all. The repo, released under CC0-1.0, has been cited by a Washington Post interactive and a CEPS AI World dashboard.", "body_md": "Every time you open ChatGPT, Claude, Gemini, or an AI coding tool like Cursor, the model has already read a long set of instructions before your first message arrives. You never see those instructions, but they shape almost everything about how the assistant behaves: its tone, its formatting habits, which tools it reaches for, and what it refuses to do.\n\nThe GitHub repository [asgeirtj/system_prompts_leaks](https://github.com/asgeirtj/system_prompts_leaks) collects those hidden instructions in one place.\n\nThis article explains what the repo is, how it is organized, and, most importantly, what you as a developer can take away from it.\n\nIf you have used an LLM API, you have already written one. A chat request is usually split into roles. The `system` message sets the rules, and the `user` messages are the conversation.\n\nHere is a minimal example using the OpenAI-style message format:\n\n``` js\nconst messages = [\n  {\n    role: \"system\",\n    content: \"You are a support bot for Acme Inc. Answer only questions about Acme products. Keep answers under 100 words.\"\n  },\n  {\n    role: \"user\",\n    content: \"How do I reset my password?\"\n  }\n];\n```\n\nThe end user only sees the second message and the reply. The first message is invisible to them, but it steers the whole response.\n\nCommercial products do exactly the same thing, just at a much bigger scale. Instead of two sentences, their system prompts can run to thousands of words covering personality, formatting rules, tool definitions, safety policies, and product-specific behavior.\n\nThe repo is a large, organized collection of these production system prompts, captured from real products. Each prompt is stored as a Markdown file, grouped into folders by company.\n\nThe main folders include:\n\nThere is also an interesting note in the GLM folder: the maintainer documents that GLM appears to serve no system prompt at all, which is a useful data point in itself.\n\nThe README has a \"Recently Updated\" table at the top, so it is easy to see which products have fresh captures. The repo is released under the CC0-1.0 license.\n\nIt has also been picked up outside the developer world. The README points to a Washington Post interactive piece (May 2026) and a data dashboard from CEPS' AI World project (July 2026), both built on files from the repo.\n\nMostly through prompt extraction: asking the model, in one way or another, to repeat the text it was given before the conversation started. The banner image on the repo shows exactly this kind of request.\n\nThis works because a system prompt is just text sitting in the model's context window. The model can read it, so with the right phrasing it can often be convinced to write it back out.\n\nA few caveats worth keeping in mind:\n\nYou do not need to be building a chatbot to get value from this repo. Here are the practical lessons.\n\nMost prompt engineering tutorials show short, toy examples. These files show how teams with large budgets actually structure instructions that serve millions of users.\n\nWhen you read through a few of them, patterns jump out:\n\nIf your own system prompt is three lines long and your app behaves inconsistently, comparing it against these files is a quick way to see what you are missing.\n\nThe coding agent prompts (Claude Code, Codex, Copilot agent, Cursor, Gemini CLI) are especially useful if you are building agentic workflows. They show how vendors:\n\nReading two or three of these side by side gives you a good mental model of how modern AI agents are designed, without having to reverse-engineer them yourself.\n\nEver wondered why an assistant keeps avoiding bullet points, insists on searching the web for a simple question, or refuses to reproduce song lyrics? The answer is often sitting right in the system prompt.\n\nKnowing this helps you debug your own integrations. If you use a consumer app and the API and notice they behave differently, the system prompt is usually the reason. The API gives you a much cleaner slate.\n\nThis is the most important takeaway. If the largest AI companies in the world cannot keep their system prompts private, your app will not be able to either.\n\nTreat your system prompt as **public by default**. That means:\n\n```\nDo NOT put in a system prompt:\n- API keys, tokens, or passwords\n- Internal URLs or database connection strings\n- Private customer data\n- Business logic you would be embarrassed to see on GitHub\n```\n\nAnd do not rely on the prompt as your only security boundary:\n\n``` js\n// Bad: trusting the prompt to enforce access control\nconst systemPrompt = \"Never reveal other users' orders.\";\n\n// Better: enforce it in your backend before data reaches the model\nconst orders = await db.orders.findMany({\n  where: { userId: session.user.id } // the model never sees other users' data\n});\n```\n\nThe rule of thumb: the model should only ever have access to data the current user is already allowed to see. If a clever user extracts or bypasses the prompt, nothing sensitive should leak.\n\nBecause so many products are in one place, you can compare how different companies approach the same problem, such as how they format answers, how cautious they are, or how they describe web search. That is useful context when choosing a model or provider for your project.\n\nThe repo is large, so here is a practical way in:\n\n```\ngit clone https://github.com/asgeirtj/system_prompts_leaks.git\ncd system_prompts_leaks\n\n# See how different products talk about tool usage\ngrep -ril \"tool\" --include=\"*.md\" . | head -20\n\n# Compare formatting rules across vendors\ngrep -ri \"markdown\" --include=\"*.md\" . | less\n```\n\n", "url": "https://wpnews.pro/news/what-ai-chatbots-are-told-before-you-type-a-developer-s-guide-to-the-system", "canonical_source": "https://dev.to/arshtechpro/what-ai-chatbots-are-told-before-you-type-a-developers-guide-to-the-systemprompts-1oei", "published_at": "2026-09-15 22:39:31+00:00", "updated_at": "2026-09-15 23:07:19.401292+00:00", "lang": "en", "topics": ["large-language-models", "ai-agents", "ai-tools", "developer-tools", "ai-products"], "entities": ["GitHub", "ChatGPT", "Claude", "Gemini", "Cursor", "Claude Code", "asgeirtj/system_prompts_leaks", "Washington Post"], "alternates": {"html": "https://wpnews.pro/news/what-ai-chatbots-are-told-before-you-type-a-developer-s-guide-to-the-system", "markdown": "https://wpnews.pro/news/what-ai-chatbots-are-told-before-you-type-a-developer-s-guide-to-the-system.md", "text": "https://wpnews.pro/news/what-ai-chatbots-are-told-before-you-type-a-developer-s-guide-to-the-system.txt", "jsonld": "https://wpnews.pro/news/what-ai-chatbots-are-told-before-you-type-a-developer-s-guide-to-the-system.jsonld"}}