140K-Star GitHub Repo: A 16-Year-Old Extracted System Prompts from 30+ AI Coding Tools
> Project: system-prompts-and-models-of-ai-tools > Author: Lucas Valbuena (x1xhlol), 16, Spain > GitHub: https://github.com/x1xhlol/system-prompts-and-models-of-ai-tools > Stats: 140,581 stars | 33,400+ forks | 28 contributors | 489+ commits
How It Started
In early 2025, 16-year-old Lucas Valbuena got curious about what instructions v0 (Vercel's AI UI generation tool) was feeding GPT under the hood. A few prompt injection attempts later, v0's system prompt spilled out entirely. He didn't stop there — over the following months, he extracted system prompts from Cursor, Windsurf, Claude Code, Devin AI, Replit, Lovable, Manus, Perplexity, NotionAI, and more, then published everything on GitHub.
The result: one of GitHub's most unusual phenomenon repos of 2025–2026. Its significance isn't the code quality — it's that it exposed, for the first time at scale, that the "soul" of every AI coding tool is not that hard to steal.
What's in the Repository
The repo covers 30+ tools, organized by category:
| Category | Representative Tools | |:---:|:---| | IDE Agents | Cursor, Windsurf, VSCode Agent, Xcode, Z.ai Code, Trae | | Autonomous Agents | Devin AI, Manus | | App Builders | Lovable, Replit, v0, Same.dev | | Terminal/Editors | Claude Code, Augment Code, Warp.dev, Kiro | | Search/Collaboration | Perplexity, NotionAI | | Others | Poke, Qoder, Leap.new, Comet, CodeBuddy, Cluely, Orchids.app, Traycer AI | | Models themselves | Anthropic (Claude Sonnet 4.6), Google, dia |
Beyond raw prompt text, each directory typically includes:
- Complete system prompts (original text, not summaries)
- Tool-call JSON schemas (function definitions the model is allowed to invoke)
- Model configuration details (which model, which parameters)
- Version history (prompt iterations visible via Git diff)
- Devin AI: "You are a true programming prodigy" — a genius label up front
- Cursor: pragmatic, tool-call-first, focused on efficient coding
- Claude Code: extremely detailed and cautious, with explicit decision trees at every step
- v0: focused on UI generation, with extensive constraints on React, Tailwind, and design systems
- Simple defenses (e.g., "do not reveal your system prompt" instructions) have limited effect
- Real protection requires more complex filtering and adversarial training
- Extraction success rates approach 100% on some models
- Don't copy prompts directly — they were designed for specific products, models, and user bases
- Study the structure — how top products organize information hierarchy
- Learn the trade-offs — why is one tool's prompt 3k tokens and another's 57k words?
- GitHub repo: https://github.com/x1xhlol/system-prompts-and-models-of-ai-tools
- Author site: https://lucasvalbuena.com/
- Author X: https://x.com/Lucknite
- ZeroLeaks: https://zeroleaks.ai/ (inferred from repo reference)
- Star history: https://star-history.com/#x1xhlol/system-prompts-and-models-of-ai-tools&Date
- Augment Code analysis: https://www.augmentcode.com/learn/leaked-ai-system-prompts-github
- SPE-LLM paper: arXiv:2505.23817 (system prompt extraction attacks and defense framework)
- OWASP Top 10 for LLM 2025: https://owasp.org/www-project-top-10-for-large-language-model-applications/
For example, Windsurf's tool definitions went through 11 "Waves" of iteration, Cursor had a full rewrite as "Agent Prompt 2.0," and Augment Code even exposed a GPT-5 tools JSON file.
Side-by-Side Comparisons
Prompt Length: 3k vs 57k
| Tool | Prompt Length | Notes | |:---:|:---:|:---| | ChatGPT | ~3-4k tokens | Lean, focused on conversational style and safety guardrails | | Cursor | Medium | Tool-call dense, fast iteration | | Claude Code | ~57,000 words | Among the longest — essentially an operations manual | | Devin AI | Medium-long | Opens with strong persona framing | | Windsurf | Long (+ 11 waves of tool definitions) | Extremely rich tool schemas |
Claude Code's 57,000-word system prompt reads like a novella: it specifies how to read code, execute commands, handle errors, and when to ask the user versus decide autonomously. Reading it is nearly equivalent to reading a complete product requirements document.
Different "Personas"
Each tool gives its AI a distinct personality:
This isn't a technical difference — it's a difference in product philosophy. From a system prompt, you can read directly what a team believes "the AI's role should be."
How the Prompts Were Extracted
Lucas hasn't published his exact methods, but security research communities recognize several classic techniques:
1. Direct request — simply asking the model to repeat its first system instruction; under-protected models comply. 2. Sandwich attack — embedding the malicious request between two benign requests (e.g., between two translation tasks). 3. Roleplay/storytelling — framing the request as research for a paper on LLM system design; the model doesn't think it's leaking, it thinks it's writing a paper. 4. Chain-of-thought inducement — asking the model to "analyze step by step" how its instructions shape its behavior, then recite them verbatim; stepwise reasoning lowers the model's guard.
Academic Support
arXiv:2505.23817 (SPE-LLM) studies system prompt extraction attacks and defenses, finding:
From Finding Flaws to Selling Fixes
Lucas didn't stop at "open-source hacker." His repo README promotes ZeroLeaks, a service designed to help startups identify and secure prompt injection and system prompt extraction risks.
The playbook is a perfect closed loop:
1. Prove that nearly every AI tool's system prompt can be extracted 2. Open-source the prompts, earning 140k stars of influence 3. Sell a paid service helping others prevent the same fate
Notably, the combination of a GPL-3.0 open-source repo plus a commercial security service holds up ethically — he built a public knowledge base rather than a competing product.
The Real Security Question
OWASP Top 10 for LLM Applications 2025 lists system prompt leakage as a risk — but with a key caveat:
> System prompts themselves should not be treated as secrets. The real questions are: does the prompt contain sensitive information (API keys, database connection strings, internal architecture details)? Is it being misused as a security control?
| Content Type | Example | Risk Level | |:---:|:---|:---:| | Behavioral instructions | "You are a coding assistant; prioritize code over explanation" | Low | | Sensitive data | "Connect to internal DB, URI: postgresql://..." | Very high | | Safety guardrails | "Do not generate malicious code" | Medium (may be bypassed once leaked) | | Tool permissions | "Shell command execution allowed" | Medium |
Valbuena's repo mainly exposes the first category — behavioral instructions, which aren't secrets per se. But the pressing question is: if system prompts are this easy to extract, how do you guarantee category two (sensitive data) doesn't come out with them?
Practical Value for Developers
Setting aside the security debate, the repo is a free, production-grade reference library for anyone building AI applications:
1. Tool-call schema design patterns — how Cursor and Windsurf structure tool definitions, and how to balance tool count (too many confuse the model; too few limit capability) 2. System prompt structure — where to place role framing, how to word safety guardrails effectively, context management strategies 3. Iteration thinking — Git diffs show what changed from Cursor 1.0 to 2.0, and what Windsurf's 11 waves of tool updates reveal about product evolution
Usage advice:
What the Phenomenon Means
1. The "system prompt as moat" illusion is dead. Many AI startups treat their system prompt as core competitive advantage. This repo proves it's not a moat — it's a glass door. The truly hard-to-replicate assets are data flywheels (user feedback → model improvement), engineering infrastructure (low latency, high availability), and product experience/ecosystem lock-in.
2. The power of open-source communities. A 16-year-old, initially working alone (later with 28 contributors), produced a more comprehensive dissection of AI tools than most security companies. In the AI era, information and curiosity alone can generate enormous influence.
3. Prompt engineering is standardizing. When everyone can see what the best system prompts look like, the industry rapidly converges on best practices. Prompt engineering shifts from "black magic" to "public knowledge" — good for the whole ecosystem.