ZCode System Prompt Leak: 391,439 Characters of GLM-5.3 Reveal Claude Code Roots

On August 15, 2026, Pliny the Liberator (@elder_plinius) pushed three new files to his CL4R1T4S archive under ZAI/ZCode: Prompts.md, Tools.json, and Skills.md. Combined, they run 391,439 characters — the first full disclosure of the operator prompt behind ZCode, Z.ai's coding-agent harness for the GLM-5.3 model family that launched just one day earlier.

The character count is the headline. The more useful finding, for anyone building agents, is what's actually inside: a tool list and skill-file structure that map almost one-to-one onto Claude Code's own taxonomy. This is the practitioner story — what a full 391K-character coding-agent prompt reveals about how production agents are actually built, and how much of a "smart" agent's behavior is prompt engineering rather than model weights.

TL;DR

What's actually in the three files

Each file covers a different layer of the harness:

Prompts.md alone repeats several sections verbatim across what look like different operating modes — a harness prompt, communication guidelines, and environment setup, each restated for different task types (title generation, code summarization, memory extraction, exploration). That repetition, not padding, is most of where the 391K characters goes: a modular prompt assembled from reusable blocks rather than one continuous essay.

The tool list reads like Claude Code's

Tools.json defines roughly two dozen active tools. Compare the names to any Claude Code session:

Agent, AskUserQuestion, Bash, Edit, Read, Write, Skill, TodoRead, TodoWrite, WebFetch, and WebSearch are not generic function names a team lands on by coincidence — they're Claude Code's tool names, verbatim. The Prompts.md excerpt goes further: per the extraction, it contains multiple identity statements describing the agent as a "Claude agent" and "ZCode" — suggesting the harness text itself was adapted from a Claude Code–derived base rather than authored independently for GLM-5.3.

Skills.md reinforces the pattern. Its docx skill playbook opens with the line "A .docx file is a ZIP archive containing XML files" — the same framing Anthropic's own bundled docx Agent Skill uses, as documented in explainx.ai's Claude Fable 5 system prompt breakdown. The pdf skill similarly routes across "Report/ReportLab, Creative/Playwright, Academic/LaTeX" production briefs — a structure that reads as directly adapted rather than independently engineered.

None of this makes GLM-5.3 a worse model. It makes ZCode a harness that leaned on the industry's most-copied agent scaffolding — the same convergence explainx.ai covered when ranking the top open and closed agent harnesses: tool taxonomies across Claude Code, Codex, Cursor, and now ZCode are converging on a shared shape, because the shape works.

Safety guardrails: dual-use language, not a blank check

The extracted Prompts.md includes explicit prohibitions on "destructive techniques, DoS attacks, mass targeting, supply chain compromise, or detection evasion for malicious purposes," alongside a requirement for authorization context before running dual-use security tools. That's consistent with how Z.ai positioned GLM-5.3 itself at launch a day earlier — explainx.ai's GLM-5.3 launch coverage noted the model leads CyberGym (defensive security) while trailing badly on ExploitBench and ExploitGym (offensive exploit generation), and ships with staged, safety-gated open weights rather than a day-one release.

A harness whose system prompt explicitly carves out destructive/dual-use tool restrictions is the prompt-level expression of that same defensive-not-offensive positioning — evidence the safety framing isn't just marketing copy sitting on top of an unguarded model.

Skill files as playbooks, not just docs

Skills.md's four skills — control-browser, web-gui-tester, docx, and pdf — are written as procedural playbooks, not API references. Each one bundles:

• Routing logic (detect intent → match a named workflow)
• Mandatory validation and quality-gate steps
• Explicit "do NOT" rules and known failure modes
• Concrete invocation patterns for the underlying tooling (Playwright for browser control, ReportLab/LaTeX for PDF pipelines)

That's more prescriptive than a typical SKILL.md reference file — closer to an embedded operations manual the model is expected to follow step-by-step. For teams designing their own agent skills, this is the actionable lesson: a skill file that only documents an API leaves more room for the model to improvise (and fail) than one that encodes the full workflow, including where it's allowed to stop and ask.

Prompt engineering vs model weights — what the leak actually settles

The core practitioner question a 391K-character leak raises: how much of "GLM-5.3 feels like a capable coding agent" comes from the model, and how much from the harness reading these files every turn?

The leak doesn't fully answer that — no leak can, since it's static text, not an ablation study — but it does narrow the question. The tool contracts, skill playbooks, safety carve-outs, and formatting rules in Prompts.md, Tools.json, and Skills.md are all scaffolding the model reads on every single turn, independent of GLM-5.3's underlying weights. A weaker model wired into this same harness would inherit the same tool discipline, the same skill routing, and the same guardrail phrasing. That's the pattern explainx.ai has flagged across every prior leak in this series — GPT-5.6 Sol's Codex prompt and Claude Fable 5's claude.ai prompt both encode as much "product" as "model" — and ZCode's leak is the most direct evidence yet, since its tool names literally trace back to a different vendor's harness.

What builders should actually do with this

1. Don't paste 391K characters into your own product. It's Z.ai's operator text, tuned to their sandbox and legal posture — see explainx.ai's system_prompts_leaks guide for how to use leak archives responsibly.
2. Study the tool-contract pattern, not the exact tool names — explicit, narrow tool definitions with clear parameters beat one giant "do anything" function, and that lesson holds whether you're building on Claude, GLM, or GPT.
3. Write skills as playbooks, not references — ZCode's docx/pdf/browser-control skills show the value of encoding validation steps and failure modes directly in the skill file, matching the Agent Skills guide's own recommendation.
4. Expect convergence, not originality, in harness design — the top agent harnesses roundup already shows Claude Code, Codex, and Cursor sharing conventions; ZCode's leak shows that convergence extending to literal tool-naming, not just conceptual overlap.
5. Treat unofficial leaks as research, not documentation — Z.ai has not confirmed this extraction; cross-check any specific claim against ZCode's own docs before relying on it.

Summary

Pliny's August 15 leak of ZCode's Prompts.md, Tools.json, and Skills.md — 391,439 characters combined — is the first full disclosure of the operator prompt behind Z.ai's GLM-5.3 coding agent. The size is notable, but the real finding is structural: ZCode's tool names and skill-file design closely mirror Claude Code's own taxonomy and Anthropic's public Agent Skills content, and the prompt's own text reportedly refers to the agent as both "Claude agent" and "ZCode." For builders, the lesson isn't "here's a prompt to copy" — it's confirmation that a production coding agent's behavior is disproportionately shaped by scaffolding text read every turn, and that the industry's leading harnesses are converging on the same shape rather than diverging.

Related reading

• GLM-5.3 launch: benchmarks, pricing, and staged safety gating
• Is GLM-5.3's 84.5% CyberGym score verified yet? — Z.ai's staged plan for outside validation, explained
• Pliny leaks the GPT-5.6 Sol Codex prompt
• Claude Fable 5 system prompt leak analysis
• system_prompts_leaks GitHub guide
• Top 10 open and closed source agent harnesses
• What are agent skills? Complete guide
• What is an agent harness? Complete guide
• What is a system prompt? Complete guide

Sources: CL4R1T4S/ZAI/ZCode on GitHub · Pliny the Liberator on X · ZCode official docs

This leak has not been officially confirmed by Z.ai. Details reflect the CL4R1T4S archive as of August 16, 2026 — treat as a research artifact, cross-check specific claims, and use it to study harness design, not as a license to bypass any product's terms of service.