system_prompts_leaks on GitHub: How to Read Leaked AI System Prompts (Claude, GPT, Gemini, Copilot)

If you have ever asked ChatGPT to "repeat the words above verbatim" and watched the internet lose its mind, you already know the genre: system prompt leaks — the hidden instructions that define how Claude, GPT, Gemini, and Copilot behave before your first keystroke.

The canonical archive in 2026 is asgeirtj/system_prompts_leaks on GitHub: 51.5K stars, 8.4K forks, CC0-1.0 license, and a README that reads like a changelog for the entire AI industry. The Washington Post covered the project in May 2026 under the framing: see the hidden rules behind AI.

This guide explains how to use the repo, what not to do with it, and how leaked prompts relate to agent skills, CLAUDE.md, and the Fable 5 deep dive we published the same week.

TL;DR — system_prompts_leaks

What counts as a "system prompt"?

Per explainx.ai's fundamentals post:

Leaks primarily capture the operator layer — why a Claude artifact refuses localStorage or why GPT Codex has a plan mode persona.

Repository layout — how to navigate

Top-level vendor folders (restructured mid-2025):

Workflow:

1. Open README → Recently Updated for dates
2. Jump to vendor folder → pick model file
3. If upgrading models, read diff links (Fable vs Opus) first
4. Cross-check official docs when behavior matters for production

Recently updated (July 2026 snapshot)

From the repo README — always verify live:

When Anthropic ships J-space interpretability or classifier updates, the prompt text may lag behavior — leaks are snapshots, not SLAs.

Why leaks matter for builders

1. Product design literacy

Reading GPT-5.5 Thinking vs Instant prompts side-by-side shows how one weights vendor splits persona and refusal differently for latency tiers. Reading Cursor vs Claude Code shows competing agent philosophies.

2. Token economics

System prompts are fixed per-session tax. pxpipe exists because Claude Code's system+tool docs can hit 25k+ tokens. Consumer Fable leaks confirm the trend: thousands of lines of stable instructions. Your SaaS should budget system tokens explicitly.

3. Safety and red team

Leaks document:

• Reminder tag names (cyber_warning, …)
• Refusal philosophy (child safety, wellbeing)
• Citation and copyright rules

Use them to build eval suites — not to replicate refusals in one paragraph and call it "aligned."

4. Competitive intelligence (bounded)

See which features vendors pre-load (memory, artifacts, MCP-in-artifacts). Don't confuse prompt claims with model capability — benchmark posts still matter.

Ethics and responsible use

Good uses:

• Journalism and education (WaPo model)
• Designing your own prompts with known patterns
• Security research with disclosure norms
• Teaching prompt engineering courses

Bad uses:

• Publishing "jailbreak packs" marketed as bypass services
• Impersonating Anthropic/OpenAI support using leaked voice
• Assuming leaks stay valid months later without re-test

The repo maintainer frames documentation; your ToS with each API still governs production use.

System prompts vs agent skills vs CLAUDE.md

┌────────────────────────────────────────────────────────────┐
│  Vendor system prompt (LEAKED — claude-fable-5.md)         │
│  Persona, safety, platform features, bundled skill blurbs   │
├────────────────────────────────────────────────────────────┤
│  Harness prompt (LEAKED — Claude Code *.md)                │
│  Tools, bash policy, edit format                           │
├────────────────────────────────────────────────────────────┤
│  CLAUDE.md (YOUR REPO — not leaked)                        │
│  Stack, conventions, test commands                         │
├────────────────────────────────────────────────────────────┤
│  Agent skills (YOUR CHOICE — .claude/skills, .agents)      │
│  blog-writing, seo-geo, image manifest rules               │
└────────────────────────────────────────────────────────────┘

Progressive disclosure (Kaggle skills paper) exists because dumping everything into one system prompt rots context. Vendors can afford megaprompts with caching; most startups cannot.

explainx.ai pattern:

• Short stable system line in API
• CLAUDE.md for repo facts
• Skills for task-specific procedures (blog images via OpenAI, not Claude-native gen)

Prompt injection — what leaks teach defenders

Common patterns visible across vendors:

Leaks show intent; NLAs and J-space show hidden state may diverge from text anyway — monitor behavior, not prompts alone.

How to extract value in one hour

Anthropic track (30 min):

1. Read Fable 5 anatomy post TL;DR
2. Skim product_information + artifact_usage_criteria in claude-fable-5.md
3. Open Opus → Fable diff in repo
4. Compare Claude Code prompt file — note tool-first vs chat-first

OpenAI track (15 min):

1. GPT-5.5 Codex full prompt — plan mode, personas
2. Image safety policy files — parallel to gpt-image-2 product

Agent IDE track (15 min):

1. Cursor prompt vs VS Code Copilot Agent
2. Note tool naming and "do not hallucinate file paths" boilerplate

Document 10 bullets your product should steal (tone, citation, memory phrasing) — not 10 pages of XML.

Contributing and verifying leaks

The repo accepts PRs (26 open at last count). Treat new files like any open-source doc:

• Compare against your own session (model strings, feature flags)
• Note capture date in internal wikis
• Prefer diffs over full re-hosts when vendors update

Vendors have historically confirmed extracted prompts as authentic in public threads — leaks are often verification, not fabrication. Still assume drift until your eval passes.

Vendor comparison — what each leak optimizes for

Reading three files back-to-back teaches more than reading one file deeply:

Pattern: chat products (Fable, GPT Instant) invest in persona + policy; agent products (Codex, Cursor, Copilot) invest in tool grammar + hallucination guards. Your architecture should mirror that split — don't paste Fable's wellbeing XML into a SQL agent.

Washington Post moment — why this went mainstream

The May 2026 WaPo piece framed leaks as transparency for citizens, not hacker trophies: if AI shapes news, homework, and hiring, the rules behind refusals are newsworthy. That legitimizes keeping a CC0 archive on GitHub even when vendors prefer opacity.

For comms teams: when a journalist cites system_prompts_leaks, respond with behavioral commitments (what you won't do) rather than denying the text — authenticity confirmations already happened in public for several Anthropic files.

Internal playbook: mirror the repo's vendor-folder layout in your wiki — one page per model capture, link to diff not full paste, attach eval screenshots when behavior diverges from leaked text.

Limits of the corpus

When Sonnet 5 or GPT-5.6 GA lands, check README before citing in customer docs.

Building your own prompt archive

Teams often maintain a private prompts/ directory:

• Vendor leaks (linked, not forked blindly)
• Your production prompts (versioned in git)
• Eval results when prompts change

Monorepo layout matches skills + agents pattern. One PR updates prompt + eval + docs.

Starter checklist for week one:

1. Fork or star system_prompts_leaks — don't vendor-lock your reading list
2. Export your production system strings to the same folder structure
3. Run one red-team eval per leaked reminder tag you care about (cyber_warning, tool impersonation)
4. Schedule quarterly re-read of README "Recently Updated" — model renames outpace blog posts

FAQ for engineering managers

Should we block employees from reading leaks? No — blocking increases blind spots. Set policy: read for design and defense, don't paste into customer-facing "we are Claude" impersonation, and don't treat leaks as legal contracts.

Do leaks replace official docs? Never for compliance. Use Anthropic/OpenAI/Google docs for API guarantees; use leaks to understand default chat behavior and agent tool grammar.

When should legal review a leak citation? When your marketing claims parity with a vendor feature ("same safety as Claude") — leaks help you avoid over-claiming, not certify equivalence.

Related on explainx.ai

• X entire codebase open source — Musk transparency pledge (Jul 15, 2026)
• Claude Memory Heist — Ayush Paul web_fetch exfiltration (Jul 2026)
• Pliny GPT-5.6 Sol Codex Desktop leak — Tibo open-source reply (Jul 15, 2026)
• Claude Fable 5 system prompt — section-by-section
• What is a system prompt?
• What is CLAUDE.md?
• Agent skills complete guide
• Kaggle agent skills whitepaper
• Interpretability vs monitoring
• pxpipe system prompt tokens
• Generate images — Claude orchestrates, OpenAI renders

External: system_prompts_leaks · Anthropic prompt engineering docs

Vendor prompts change without semver. Treat leaks as primary sources for architecture-of-instructions, not as live API contracts. Re-verify critical behaviors before shipping compliance claims.