GitHub Repo Aggregates Extracted System Prompts from Major AI Providers

What Happened

A GitHub repository, asgeirtj/system_prompts_leaks, has aggregated extracted system prompts from multiple frontier model providers, covering Anthropic (Claude, Claude Code), OpenAI (GPT series, Codex), Google (Gemini), and xAI (Grok). The repository gained 727 stars in a single day and is maintained with regular updates as new extractions surface. Provenance of individual prompts is unverified; the collection mixes outputs from prompt-extraction techniques, reverse-engineering, and in some cases likely reproduction from memory or inference.

Why It Matters

System prompts encode the operational contract between a model and its deployment: refusal boundaries, tool-use conventions, persona constraints, output formatting rules, and hidden safety scaffolding. For teams building agents, this repository compresses months of trial-and-error prompt engineering into a comparable corpus. The primary beneficiaries are prompt engineers, agent framework developers, and evaluation teams who need reference points for how major labs structure instructions across tool calls, multi-turn reasoning, and safety gates. The limitation is epistemic: unverified provenance means any given prompt may reflect an earlier model revision, a partially reconstructed variant, or a deliberately modified copy. Treat the corpus as directional scaffolding, not ground truth.

Technical Details

The prompts span multiple deployment surfaces — consumer chat, API system roles, and coding agents like Claude Code and Codex — which differ structurally in tool declarations, reasoning traces, and refusal phrasing. The Claude Code prompt, for example, emphasizes file-editing protocols and shell safety; OpenAI's Codex prompts emphasize diff discipline and test-first behavior. No API, schema, or dataset release accompanies the repository; content is plain text files organized by provider and product. Extraction methods vary: some entries derive from prompt-injection leakage, others from token-level probing, and a subset appears paraphrased. There is no versioning tied to model checkpoints, so mapping a prompt to a specific model snapshot requires cross-referencing release dates manually. Absence of a license or provenance manifest limits downstream commercial use.

Operational Impact

Agent developers gain a reusable library of instruction patterns — particularly around tool-schema definitions, multi-step planning constraints, and refusal language — that can be adapted rather than re-derived. Teams evaluating model behavior can use the corpus to design probes: if a deployed model refuses or complies inconsistently with its documented prompt structure, that is a signal for prompt-injection exposure or version drift. Red-team and safety teams benefit from seeing where refusal scaffolding sits relative to task instructions, informing jailbreak testing. The corpus does not replace vendor documentation or contractual guarantees; it supplements them with empirical reference. Cost of prompt iteration drops modestly for teams without prior exposure to frontier vendor patterns, but the absence of version tags means the repo cannot serve as a compliance artifact.