8.0
热点
AI SCORE
编程提效2026-09-16 06:39
AI 对话机器人的隐藏指令系统详解
dev.to · AI#AI工具#Prompt工程#系统提示词
Editor brief · 编辑速览
系统提示词决定了 AI 助手的行为风格、工具调用和拒绝边界，GitHub 仓库收集了主流 AI 产品泄露的系统提示词，可供开发者借鉴设计自己的 AI 应用。
Every time you open ChatGPT, Claude, Gemini, or an AI coding tool like Cursor, the model has already read a long set of instructions before your first message arrives. You never see those instructions, but they shape almost everything about how the assistant behaves: its tone, its formatting habits, which tools it reaches for, and what it refuses to do.
The GitHub repository asgeirtj/system_prompts_leaks collects those hidden instructions in one place.
This article explains what the repo is, how it is organized, and, most importantly, what you as a developer can take away from it.
If you have used an LLM API, you have already written one. A chat request is usually split into roles. The system message sets the rules, and the user messages are the conversation.
Here is a minimal example using the OpenAI-style message format:
const messages = [
{
role: "system",
content: "You are a support bot for Acme Inc. Answer only questions about Acme products. Keep answers under 100 words."
},
{
role: "user",
content: "How do I reset my password?"
}
];
The end user only sees the second message and the reply. The first message is invisible to them, but it steers the whole response.
Commercial products do exactly the same thing, just at a much bigger scale. Instead of two sentences, their system prompts can run to thousands of words covering personality, formatting rules, tool definitions, safety policies, and product-specific behavior.
The repo is a large, organized collection of these production system prompts, captured from real products. Each prompt is stored as a Markdown file, grouped into folders by company.
The main folders include:
Anthropic: Claude.ai chat prompts for several model versions, Claude Code (including subagents, slash commands, and injected reminders), and integrations such as Claude in Chrome, Excel, Word, and PowerPoint.
OpenAI: ChatGPT prompts across model versions, Codex (including plan mode and computer use), voice modes, memory, and older tool prompts like Canvas and the Python tool.
Google: Gemini app prompts, Gemini CLI, NotebookLM, Jules, AI Studio, and Google Search AI Mode.
xAI: Grok versions, personas, and safety instructions.
Microsoft: GitHub Copilot, the VS Code Copilot agent, and Copilot CLI.
Others: Cursor, Perplexity, Meta AI, Mistral, DeepSeek, Kimi, Qwen, Notion AI, and a "Misc" folder with tools like Warp, Zed, Docker's Gordon, Raycast, and Kagi.
There is also an interesting note in the GLM folder: the maintainer documents that GLM appears to serve no system prompt at all, which is a useful data point in itself.
The README has a "Recently Updated" table at the top, so it is easy to see which products have fresh captures. The repo is released under the CC0-1.0 license.
It has also been picked up outside the developer world. The README points to a Washington Post interactive piece (May 2026) and a data dashboard from CEPS' AI World project (July 2026), both built on files from the repo.
Mostly through prompt extraction: asking the model, in one way or another, to repeat the text it was given before the conversation started. The banner image on the repo shows exactly this kind of request.
This works because a system prompt is just text sitting in the model's context window. The model can read it, so with the right phrasing it can often be convinced to write it back out.
A few caveats worth keeping in mind:
Captures are not official. These are not documents published by the vendors, so treat them as snapshots rather than a guaranteed source of truth.
Prompts change constantly. Vendors update them frequently, sometimes weekly. A file might describe last month's behavior.
Some text is dynamic. Dates, user locations, enabled tools, and feature flags are often injected at runtime, so two users can receive slightly different prompts.
Models can hallucinate. An extraction can include invented or garbled sections, which is why cross-checking multiple captures matters.
You do not need to be building a chatbot to get value from this repo. Here are the practical lessons.
Most prompt engineering tutorials show short, toy examples. These files show how teams with large budgets actually structure instructions that serve millions of users.
When you read through a few of them, patterns jump out:
Structure with tags or headers. Many prompts group rules into clearly labeled sections (formatting, tools, safety, product info) instead of one long paragraph. This makes them easier for the model to follow and easier for humans to maintain.
Explain the why, not only the rule. Good prompts often give a short reason behind an instruction. Models generalize better when they understand the intent.
Use examples. Prompts frequently include sample requests with good and bad responses, which is one of the most reliable ways to pin down behavior.
Be explicit about edge cases. A lot of text is spent on situations that go wrong in practice: ambiguous requests, conflicting instructions, stale information.
If your own system prompt is three lines long and your app behaves inconsistently, comparing it against these files is a quick way to see what you are missing.
The coding agent prompts (Claude Code, Codex, Copilot agent, Cursor, Gemini CLI) are especially useful if you are building agentic workflows. They show how vendors:
Reading two or three of these side by side gives you a good mental model of how modern AI agents are designed, without having to reverse-engineer them yourself.
Ever wondered why an assistant keeps avoiding bullet points, insists on searching the web for a simple question, or refuses to reproduce song lyrics? The answer is often sitting right in the system prompt.
Knowing this helps you debug your own integrations. If you use a consumer app and the API and notice they behave differently, the system prompt is usually the reason. The API gives you a much cleaner slate.
This is the most important takeaway. If the largest AI companies in the world cannot keep their system prompts private, your app will not be able to either.
Treat your system prompt as public by default. That means:
Do NOT put in a system prompt:
- API keys, tokens, or passwords
- Internal URLs or database connection strings
- Private customer data
- Business logic you would be embarrassed to see on GitHub
And do not rely on the prompt as your only security boundary:
// Bad: trusting the prompt to enforce access control
const systemPrompt = "Never reveal other users' orders.";
// Better: enforce it in your backend before data reaches the model
const orders = await db.orders.findMany({
where: { userId: session.user.id } // the model never sees other users' data
});
The rule of thumb: the model should only ever have access to data the current user is already allowed to see. If a clever user extracts or bypasses the prompt, nothing sensitive should leak.
Because so many products are in one place, you can compare how different companies approach the same problem, such as how they format answers, how cautious they are, or how they describe web search. That is useful context when choosing a model or provider for your project.
The repo is large, so here is a practical way in:
Start with the product you use most. If you live in Cursor or Copilot, open that file first. It will immediately explain some behavior you have noticed.
Read one chat prompt and one agent prompt. For example, a ChatGPT or Claude chat prompt, then a coding agent prompt. The contrast is instructive.
Clone it and search locally. Grep across vendors to see how each one handles a topic.
git clone https://github.com/asgeirtj/system_prompts_leaks.git
cd system_prompts_leaks
# See how different products talk about tool usage
grep -ril "tool" --include="*.md" . | head -20
# Compare formatting rules across vendors
grep -ri "markdown" --include="*.md" . | less
Borrow patterns, not text. Use the structure and techniques in your own prompts, but write instructions that fit your product rather than copying a vendor's prompt wholesale.