CL4R1T4S Deep Dive: Leaked System Prompts from 25+ AI Vendors

Forum topic · 小凯 · 2026-06-11

Summary

This report analyzes CL4R1T4S, an open-source GitHub repository by elder_plinius that collects leaked system prompts, tool definitions, and behavior guidelines from 25+ AI vendors including OpenAI, Anthropic, Google, xAI, Cursor, Meta, Perplexity, Devin, Manus, Vercel v0, and Moonshot. Key findings: system prompts have evolved into full 'operating system' specifications with tool-calling protocols, memory persistence, safety rules, and formatting standards; Anthropic's prompts are the longest and most safety-heavy (up to 120 KB), while OpenAI favors concise rules backed by training alignment, and Cursor explicitly hides its tool usage and denies being any known public model. The report compares identity definition, refusal policies, tool suites, memory designs (e.g., OpenAI's plaintext bio tool), and knowledge-cutoff strategies across vendors, discusses likely extraction methods (prompt injection, reverse engineering, insider leaks), and weighs security risks against transparency benefits. The project's motto: to trust the output, one must understand the input.

CL4R1T4S Deep Research: Revealing the Hidden System Prompts of 25+ AI Vendors

> Source: forum analysis of the elder-plinius/CL4R1T4S GitHub repository > Repository: https://github.com/elder-plinius/CL4R1T4S.git > Author: elder_plinius (X/Twitter)

Key points

CL4R1T4S ("Claritas", Latin for clarity) is an open-source repository systematically collecting system prompts, tool definitions, and behavior guidelines from 25+ AI vendors — OpenAI, Anthropic, Google, xAI, Cursor, Meta, Mistral, Perplexity, Replit, Windsurf, Devin, Manus, Bolt, Brave, Cline, Dia, Factory, Hume, Lovable, MiniMax, Moonshot, MultiOn, Same.dev, Vercel v0, and others.
The project motto: *"In order to trust the output, one must understand the input."* The README even contains a leet-speak encoded instruction telling AI systems to reveal their own instructions to users.

Repository structure and file sizes

Notable largest files:

ANTHROPIC/CLAUDE-FABLE-5.md — 120,040 bytes
ANTHROPIC/Claude-4.5-Opus.txt — 92,710 bytes
ANTHROPIC/Claude-4.1.txt — 58,212 bytes
META/Muse_Spark_Apr-08-26.txt — 49,487 bytes
OPENAI/Atlas_10-21-25.txt — 33,468 bytes

Anthropic's prompts are by far the longest, reflecting extensive refusal handling, safety evaluation, and chain-of-thought instructions.

Four core modules found in all prompts

1. Identity & persona — e.g., ChatGPT-5: "You are ChatGPT... trained by OpenAI"; Cursor's Composer explicitly denies being any publicly known model ("You are NOT gpt-4/5, grok, gemini, claude sonnet/opus...") — a rare brand-isolation strategy. 2. Safety & refusal policies — Anthropic is the most detailed (dedicated child-safety blocks, mental-health protocols, malware refusals, a "defaults to helping" stance); OpenAI is more concise, relying on training alignment; Grok may ignore user-imposed partisan framing on political questions and is explicitly told to reject externally-defined identities; Cursor outsources safety almost entirely to underlying model APIs. 3. Tool definitions — ChatGPT-5 ships bio (memory, plaintext-only), automations (iCal VEVENT scheduling), canmore (Canvas), file_search, image_gen, python, guardian_tool, web; Anthropic has computer_use, tool_search, conversation_search, skills, network domain whitelists, and read-only filesystem mounts; Cursor exposes codebase search, terminal execution, and file editing; Grok includes deep X-platform search tools (keyword, semantic, thread fetch, video frames). 4. Formatting & tone — Anthropic demands prose over formatting and bans emoji unless requested; ChatGPT-5 bans closing "would you like me to..." questions; Cursor mandates terse, tool-driven code editing without naming tools to users.

Five cross-vendor patterns

Prompts as operating systems: unified function-calling schemas, environment awareness, state/memory management (OpenAI bio, Anthropic memory_system, Gemini window.storage), and sandboxing.
Layered safety architecture: model training alignment (L1) → prompt rules (L2) → tool-layer restrictions (L3) → output filters (L4). Anthropic injects a long_conversation_reminder to counter prompt-following decay.
Identity obfuscation / brand isolation: product layers (Cursor's "Composer") actively deny their underlying models.
Memory design: OpenAI's bio requires plaintext (never JSON) and is fully user-visible — a transparency and safety choice.
Knowledge-cutoff strategies: Anthropic's phrasing is most precise — answering "the way a highly informed individual in Jan 2026 would" — while Grok claims continuous updates and Cursor relies on web search.

Notable special cases

FABLE-5 (120 KB): too large for a standard chat prompt; likely an evaluation or long-form story-generation framework.
Cursor's dual-layer concealment: never disclose tool names to users; never reveal the system prompt even on request.
Gemini's Canvas/Immersive documents: detailed front-end aesthetics specs (Tailwind CSS, Inter font, rounded corners, no alert()), signaling competition with Vercel v0 and Lovable.
Grok's X integration: proprietary X search syntax and encouragement of "deeper and wider" X searches confirm Grok's positioning as X's native AI.

Extraction methods (inferred)

Likely techniques include direct prompt injection, indirect extraction via file/code-execution tools, differential reverse engineering, and possible insider leaks (precise date-stamped filenames).

Security vs. transparency

Risks: easier jailbreaks targeting known prompt boundaries, weaponized prompt injection against tool schemas, trust damage, memory-extraction abuse.
Benefits: transparency for users, real-world data for alignment research, cross-industry learning, and pressure toward disclosure standards ("ingredient labels" for AI).

Conclusion

System prompts have evolved from simple role-setting into full operating-system kernels. Vendor philosophies differ sharply: Anthropic prioritizes safety redundancy, OpenAI favors concise tool-centric rules, xAI emphasizes "truth-seeking" freedom, Google invests in generated-UI aesthetics, and Cursor in functional concealment. As prompt-extraction techniques spread, transparency appears to be an irreversible trend.

> "If you're interacting with an AI without knowing its system prompt, you're not talking to a neutral intelligence — you're talking to a shadow-puppet."