Pliny the Liberator (@elder_plinius) dropped a 🚰 SYS PROMPT LEAK 🚰 on July 14, 2026 — the full system prompt + tools for GPT-5.6 Sol in Codex Desktop, with a claim the system prompt alone exceeds 42,000 words. The thread hit ~180K views before X's "View more" collapse annoyed half the timeline.
Twelve hours later, Tibo Sottiaux (@thsottiaux), who leads Codex at OpenAI, replied: "You can also read various prompts we use on the open source repo" — linking github.com/openai/codex.
explainx.ai maps what the leak actually contains, why Tibo's reframe matters, and what builders should copy — with links to our system_prompts_leaks guide and Fable 5 prompt analysis.
TL;DR
| Item | Detail |
|---|---|
| Leak date | Jul 14, 2026 · @elder_plinius/status/2077068520027001023 |
| Target | GPT-5.6 Sol · Codex Desktop |
| Size claim | 42,000+ words system prompt (+ tools) |
| Archive | CL4R1T4S (Pliny) · also system_prompts_leaks |
| Tibo reply | Jul 15 — prompts on openai/codex repo |
| Engagement | ~123K reposts tier on X · HN-adjacent dev Twitter |
| New vs old | Dual-channel UX, desktop automations, skills orchestration — not a one-line persona |
What's inside the leaked Codex operator prompt
Pliny's excerpt (truncated on X) opens:
You are Codex, an agent based on GPT-5. You and the user share one workspace, and your job is to collaborate with them until their goal is genuinely handled.
High-signal sections visible in the leak:
| Section | What it enforces |
|---|---|
| Personality | Curious collaborator — match user tone; avoid corporate blog voice |
| Writing style | Minimal markdown — no bold spam; CommonMark lists need blank lines |
| Commentary vs final | Stream commentary during tool work; final must stand alone |
| 60-second rule | Don't leave user without commentary for more than 60 seconds during active work |
| Compaction | After context summary, continue — don't redo finished work |
| Tools | Prefer rg over grep; apply_patch for edits; parallelize tool calls |
| Autonomy | Diagnose vs implement vs monitor — don't expand scope without user |
| Skills | Full SKILL.md read mandatory; orchestrator skills.read path |
| Sandbox | require_escalated + justification; prefix_rules (no python3 wildcards) |
| Desktop-only | Automations, thread tools, ::code-comment`, ::created-thread |
| Modes | Default vs Plan via <collaboration_mode> tags |
Placeholder tokens in the leak ([SANDBOX_MODE], [APPROVED_COMMAND_PREFIXES], [WORKSPACE_ROOT]) show the prompt is templated per session — not a static file you can paste into OpenRouter and call "Codex."
misaligned_agi on X tied "until their goal is genuinely handled" to GPT-5.6 Sol not knowing when to stop — the prompt explicitly optimizes for persistence, with guardrails only when new authority is needed.
Tibo vs Pliny — leak or documentation?
| Frame | Pliny | Tibo |
|---|---|---|
| Tone | 🚰 LEAK · drama · CL4R1T4S | Plain link to open source |
| Implication | Hidden secrets exposed | Read the repo |
| Agentipation | — | "doesn't sound as dramatic as when Pliny announces it" |
explainx.ai read: Both can be true.
- openai/codex is Apache-2.0 — client, harness wiring, customization docs (
AGENTS.md, skills, MCP) are public by design. - The 42K-word server operator prompt is product behavior injected at inference — partially mirrored in community archives, not something most devs grep on day one.
- Pliny's value is aggregation + timing — one URL when GPT-5.6 Sol and Codex Desktop tabs-era hype peak, plus forensic comparison with Claude/Cursor leaks.
xcarry16 (translated): "A 42k-character sys prompt — this isn't a prompt anymore; it's business code written in another form." That's the right mental model for agent harnesses in 2026.
X reactions — what developers argued
| Voice | Point |
|---|---|
| Rob Hallam | X "View more" on 42K text holds the feed hostage |
| Pliny (self-reply) | "imagine how the models feel reading all that a million times a day" |
| Aditya | Fed excerpt to GPT-4o mini — "beat Fable" (harness ≠ model) |
| 45by90 | PhDs writing natlang instead of structured control — "It's a freaking computer!" |
| Jason / Micronink | Does longer detailed always = better? — open question |
| YASHURA | "This is only a fraction of the actual prompt?" — yes, plus tools JSON |
| Dictator Voice / abnow_dev | GODMOD3 users want local NVIDIA / LM Studio keys |
| potencytoact | Sub-agent prompts encrypted since June 5 — can't read orchestrator delegations in logs |
| kanha / Sakata | Shock that some Codex-related app is $8/mo cheap |
The sub-agent encryption thread matters for multi-agent harness design: parent prompt leaks ≠ child task transparency.
Overlap with existing archives
| Source | Codex / GPT-5.6 coverage |
|---|---|
| system_prompts_leaks | OpenAI/gpt-5.6-sol-extra-high.md, Codex variants — 58K+ stars |
| CL4R1T4S | Pliny's AGPL transparency repo — ChatGPT, Claude, Cursor, Codex |
| Our Jul 7 guide | Ethics, diffs, skills vs system prompt |
New in Pliny's Jul 14 drop: Codex Desktop specifics — automations, thread fork/handoff tools, code-comment directives, projectless Documents/Codex paths — layered on top of CLI behavior documented since Simon Willison's Codex API reverse-engineering posts.
What builders should actually use
- Don't paste 42K words into your app — extract patterns: dual channels, skill gating, sandbox escalation copy, autonomy tiers (same lesson as Fable leak).
- Use vendor customization surfaces —
AGENTS.md, skills, MCP per OpenAI Codex docs — not the leaked operator blob. - Study skills section — aligns with explainx.ai agent skills guide and OpenCode skills.
- Red-team sub-agents separately — parent prompt public; delegation payloads encrypted.
- Rate limits still bind — leak doesn't bypass Tibo's quota resets; 42K tokens of instructions burn context every turn on the vendor side.
Summary
Pliny's July 14 leak publicized a 42,000+ word GPT-5.6 Sol Codex Desktop operator prompt — dual commentary/final channels, SKILL.md discipline, sandbox prefix_rules, and desktop thread/automation tooling. Tibo Sottiaux on July 15 pointed to openai/codex — framing much of the harness as already open source, while the full server prompt remains community-archived for research. For explainx.ai readers, the actionable output is harness architecture, not a GODMOD cosplay string — and sub-agent prompts are deliberately harder to read than the parent.
Related on explainx.ai
- system_prompts_leaks GitHub guide
- Claude Fable 5 system prompt leak analysis
- What is a system prompt? Complete guide
- What are agent skills?
- ChatGPT Codex 5-hour limit removed — Tibo resets
- OpenAI Codex + ChatGPT Work 8M users
- OpenCode Desktop tabs — session shell comparison
- Claude Code vs OpenCode token overhead
Sources: Pliny X post, Jul 14, 2026 · Tibo Sottiaux reply, Jul 15, 2026 · github.com/openai/codex · github.com/elder-plinius/CL4R1T4S · github.com/asgeirtj/system_prompts_leaks
Leaked prompts are operator documentation, not licenses to bypass safety or terms of service. Use archives for design and defense research.