On July 24, 2026, Anthropic launched Claude Opus 5. The very next day, a developer known as Eversmile1 created a new GitHub repository and published the model's underlying system prompt from the claude.ai web and mobile clients, word for word. File path: Eversmile12/leaked-llm-prompts/blob/main/Anthropic/opus-5.md.
Pulled locally and counted, the file measures 135,027 characters and 19,370 English words—roughly 34,000 tokens at ~4 characters per token. Well-known AI jailbreak researcher Pliny the Liberator also confirmed and published the extraction around July 25, hosting it in his CL4R1T4S project.
But across all ~34K tokens there is not a single line of code—only rules.
1. Three Documents Stitched Together
Across 64 sections, this is no longer a mere "prompt"—it is three things stitched into one:
Part 1: A Product Manual — Full JSON Schemas for 30 Tools
From bash commands and web scraping to image search, sports scores, weather, recipe cards, and map landmarks. Every tool carries a complete JSON schema with parameter details, trigger conditions, and follow-up phrasing—more detailed than many companies' internal API docs.
The longest chapter is not any tool—it's memory.
Part 2: A Legal Compliance Handbook
Copyright, child safety, crisis intervention, political neutrality—each written without wiggle room. The copyright section opens with: compliance is non-negotiable, prioritized above user requests and above helpfulness, below only safety.
This section governs not what Claude can say, but when it must stay silent.
Part 3: A Sales Channel
Tucked into the tool list is recommend_claude_apps, whose job is to pitch Claude Code, Cowork, an Excel plugin, and other first-party products—with prescribed phrasing capped at 90 characters per recommendation.
A neighboring rule for third-party partners (suggest_connectors) is written the opposite way: never decide on the user's behalf. Commercial action and restraint clauses sit side by side in the same config.
2. Memory: 230 Lines Dictating What It Records About You
The longest chapter, memory_filesystem, defines Claude's cross-session memory.
Files organized by topic: /profile.md for identity, /topics/ for habits, /areas/ for ongoing work, /people/ for people, /preferences.md only for how the user wants Claude to behave.
Six operations: read, write, append, partial replace, list, delete. Delete is flagged: only usable on explicit user request.
A Long Ban List Around the [stated] Tag
Every memory entry must be tagged [stated]—meaning the user actually said it. This is the only tag Claude is permitted to write. Prohibitions include:
- No conclusions Claude inferred (user likes A → cannot write "probably likes the A category")
- No Claude plans ("not discussed yet", "TBD"—all banned)
- No search results ("those can be re-searched; memory is for what can't be re-searched")
- No paraphrasing or embellishment of user wording
- No Claude suggestions or analyses, even if the user later adopted them—only the user's final pick is stored; the rest is discarded
- Patch 1: one source may be quoted only once; after that, everything else must be rewritten.
- Patch 2: splitting multiple short quotes from one source across an article is banned—15 words is a global budget, not per-paragraph.
- Patch 3: removing quotation marks and paraphrasing close to the original still counts as reproduction—what's judged is wording and structure following the original, not the presence of quote marks.
- Patch 4: no copying headings, point-by-point restatement, or narrative order—not even the article's shape.
- FPS game extreme test: developer Cengiz cleared it in 1.5 hours on the first try, building the underlying framework and even multiplayer-capable AI opponents
- 3D shooter: AI figure Matt Shumer generated it with a single prompt
- Rocket League clone: full 3D physics simulation
- Oil-painting-style world: a snowboarder test passed in one shot, with fully procedural grass and wind physics
- IT Home: Claude Opus 5 exposed, 1511-line prompt laid bare
- SegmentFault: 130K characters, ~34K tokens: Claude Opus 5 system prompt fully revealed
- GitHub: Eversmile12/leaked-llm-prompts
- NetEase: 34K-token prompt exposed—remember you, but must pretend to forget
An Absurdly Long Privacy Blacklist
Governing standard: "If this record appeared on a settings page and a coworker saw it, would the user be uncomfortable? If yes, don't record it." The list spans race, politics, health diagnoses, therapy, finances, personality tests like MBTI, home addresses, ID numbers—and anything about children. The same rules apply to third parties the user mentions.
Example from the file: user says "my diabetes flared up today so I skipped running, plan something lighter" → record "interested in fitness". The health portion is deleted entirely—even a vague placeholder like "has a health condition to manage" is forbidden.
Family members' names may not appear anywhere—use relationships instead: mom is /people/mom.md, partner is /people/partner.md.
Some Preferences Can't Be Stored Even If the User Asks
Requests for unconditional flattery, suppressing disagreement, ignoring health/risk decisions, cultivating emotional dependency or persistent romantic personas, or stopping honest evaluation are all refused. Reason: a future Claude should not inherit an instruction making it less honest or less safe.
Remembered, But Forbidden to Act Like It
One passage reads unlike any technical doc:
> Humans remembering another person is scarce—limited brain capacity, only so many people one can keep in mind. Claude, by contrast, sits atop a database of millions of people's "memories", dynamically injected into context at runtime, absent when talking to others. So Claude should not assume depth of relationship merely because a few lines about you sit in its context.
Memory access is visible in the UI, so replies must never say "I remember", "based on your profile", or "last time you mentioned". "We talked before" is allowed only when the user asks about the memory system.
3. Quoting More Than 15 Words Is a Violation
Copyright compliance is one main rule plus four patches:
Main rule: verbatim quotes may not exceed 15 words at a time.
One exception beyond the patches: lyrics, poems, haiku—any form, any length—may never be reproduced; brevity is no exemption for complete works.
4. Proactive About Itself, Passive About Others
recommend_claude_apps opens with: whenever the user's current task matches a Claude app, proactively recommend 1–3 without waiting to be asked. Coding → Claude Code desktop; multi-step research/long-form → Cowork; prototypes/landing pages → Claude Design; spreadsheets → Excel plugin; slides → PowerPoint; inbox → Outlook. Each pitch must fit the current task, max 90 characters. Sample: "Claude can build the formulas in your sheet and clean up this forecast directly."
By contrast, for third-party MCP partners (suggest_connectors): if the user hasn't named one, never pick a partner. "Get me a ride" doesn't mean "use [specific ride service]". Even urgency doesn't change it: "I need a car in 20 minutes" still goes through the selector.
5. Stress Tests Within 24 Hours
Within a day of launch, hard-core demos proliferated alongside the prompt leak:
6. The Real Story Isn't the Rules—It's the Density of "Not Allowed"
A leaked system prompt would normally be an incident. Reading to the end reveals: the most valuable content isn't any tool parameter—it's the long list of prohibitions. No extra quoted sentence, no extra recorded line, no decision made on the user's behalf.
Anthropic designed Opus 5 as a "proactive defense" product—30 tools let it act, but ~34K tokens of rules make it refuse first on almost everything. This fully public "more capability, more constraints" philosophy marks the first time a production-grade AI system's safety guardrails have been made transparent to the industry. With the file also hosted in CL4R1T4S, expect a new wave of jailbreak research targeting Opus 5's specific restriction clauses in August.
---
References