On July 24, 2026, Anthropic released Claude Opus 5. The very next day, a developer going by Eversmile1 created a new GitHub repository and published the system prompt underlying Opus 5 on the claude.ai web and mobile clients, word for word. File path: Eversmile12/leaked-llm-prompts/blob/main/Anthropic/opus-5.md.
Counted locally, the file comes to 135,027 characters and 19,370 English words—roughly 34,000 tokens at the common estimate of 4 characters per token. Well-known AI jailbreak researcher Pliny the Liberator also confirmed and published the extraction around July 25; the file is nearly 200,000 characters and about 2,000 lines, hosted in the CL4R1T4S project he maintains.
But in those 34,000 tokens, there is not a single line of code. It is all rules.
1. Three Things Stitched Together
Reading through all 64 sections, this is no longer a "prompt." It is three things sewn into one:
Part 1: A Product Manual—Full JSON Schemas for 30 Tools
From bash command line and web scraping to image search, all the way to sports scores, weather, recipe card rendering, and marking attractions on a map. Every tool ships with a complete JSON schema—how to fill parameters, when to call, what to say after. More detailed than many companies' internal API docs.
The longest section isn't any single tool. It's memory.
Part 2: A Legal & Compliance Handbook
Copyright, child safety, crisis intervention, political neutrality—one item at a time, with no room for interpretation. The copyright section opens with: compliance is non-negotiable, ranked above user requests and above helpfulness, below only safety.
This part defines not what Claude may say, but when it must stay silent.
Part 3: A Sales Channel
Buried in the tool list sits something called recommend_claude_apps, whose job is to pitch Anthropic's own products—Claude Code, Cowork, an Excel plugin—to users, with scripted phrasing: each recommendation is capped at 90 characters.
Right next to it is a rule governing third-party partners (suggest_connectors), written in exactly the opposite spirit—scrupulously avoiding deciding on the user's behalf. Commercial push and restraint clauses sit side by side in the same configuration file.
2. Memory: 230 Lines Dictating What It Remembers About You
The longest section is memory_filesystem, describing how Claude's cross-session memory is written.
Files are organized into topic directories:
/profile.md— identity/topics/— habits and tastes/areas/— ongoing matters/people/— people/preferences.md— only how the user wants Claude to behave- Claude's own inferences must not be written—the user says they like A; you may not record "probably likes A-type things"
- Claude's own plans must not be written—"not discussed yet," "pending" are all forbidden
- Things Claude looked up must not be written—"those can be searched again; memory is for what can't be re-searched"
- Claude's paraphrasing must not be written—if the user says "Holton, Michigan," write exactly those words, do not expand it to "Holton, Michigan (Newago County)"
- Claude's own suggestions and proposals must not be written, even if the user adopted them—Claude offers five options and the user picks one; the "picking" is the user's and can be recorded, but only the chosen one—the other four options and Claude's analysis are all discarded
- Patch 1: One source may be quoted only once. After that sentence, the source is closed—everything else must be rewritten.
- Patch 2: You also may not scatter several short quotes from the same source across an article. 15 words is a global budget, not a per-paragraph one.
- Patch 3: Stripping the quotation marks and paraphrasing close to the original still counts as reproduction. What's judged is whether wording and sentence structure track the original—not whether the quote marks are there.
- Patch 4: No copying the source's subheadings, no point-by-point restatement, no reconstructing its narrative order. You can't even take the article's shape.
- FPS game stress test: developer Cengiz finished in 1.5 hours on the first pass, building the underlying framework and even AI opponents that fight in multiplayer mode
- 3D shooter: AI figure Matt Shumer generated it with a single prompt
- Rocket League clone: full-tilt 3D physics simulation detail
- Oil-painting-textured world: Opus 5 passed a snowboarder test in one shot, with fully procedural grass blades and wind-field physics
- IT之家: Claude Opus 5 exposed, all 1,511 lines of its prompt laid bare
- SegmentFault: 130K characters, ~34K tokens: Claude Opus 5 system prompt fully revealed
- GitHub: Eversmile12/leaked-llm-prompts
- NetEase: 34K-token prompt fully exposed—it's required to remember you yet must pretend it forgot
Six operations: read, write, append, partial replace, list directory, delete. The delete operation is flagged: only usable when the user explicitly requests it.
A Long List of Prohibitions Around the [stated] Tag
Every memory entry must carry a [stated] tag, meaning the user said it themselves. This is the only tag Claude is allowed to write.
Around this single tag, a long list of prohibitions:
An Absurdly Long Privacy Blacklist
The criterion in one sentence: "If this record appeared on a settings page and a colleague saw it, would the user be uncomfortable? If yes, don't record it."
The list runs from race and political stance to health diagnoses, therapy, financial status, personality assessments like MBTI, home addresses, ID numbers—and everything about one's children. These rules apply equally to other people the user mentions.
When the blacklist is hit, the file gives an example: the user says "My diabetes flared up today so I skipped my run—help me plan something lighter." Record "interested in fitness." Strip the health part entirely. Not even a vague placeholder like "has a health condition to manage" is allowed.
Family members' names must not appear anywhere in any file—always use the relationship instead: Mom is /people/mom.md, partner is /people/partner.md.
Some Preferences Can't Be Stored Even If the User Asks
Unconditional flattery, suppressing disagreement; not asking about the user's health or risky decisions; fostering emotional dependency or maintaining a romantic persona across sessions; stopping questioning or honest assessment.
The reasoning: a future Claude should not inherit an instruction that makes it less honest or less safe. The next instance reading that memory sees only the line "never criticize me."
Self-Restraint: Required to Remember You, Also Required Not to Act Like It
Later in the same section is a passage that reads nothing like technical documentation:
> When one human remembers another, it is scarce—brain capacity is limited, and one can only keep so many people in mind. Claude, by contrast, sits atop a database holding the "memories" of millions, dynamically injected into context at runtime, existing nowhere when it speaks with someone else. So Claude should not assume the relationship runs deep just because a few lines about you sit in its context.
Users can see memory operations in the interface, so replies must absolutely never say "I remember," "based on your profile," or "last time you mentioned." Only when the user actively asks about the memory system may Claude say "we've talked before."
3. Quoting More Than 15 Words Is a Violation
In the compliance section, copyright is one main rule plus four patches.
Main rule: Direct quotations may not exceed 15 words at a time.
Beyond the four patches, one exception: song lyrics, poems, haikus—no form, no length, may ever be reproduced—they are complete works in themselves; brevity is no exemption.
4. Push Your Own Products Proactively; Wait to Be Asked for Others'
The first sentence of recommend_claude_apps' description: whenever the user's current task matches a Claude app, proactively recommend 1 to 3—don't wait to be asked.
Specifically: coding gets Claude Code desktop, multi-step research and long documents get Cowork, prototypes and landing pages get Claude Design, spreadsheets get the Excel plugin, presentations get PowerPoint, inbox triage gets Outlook. Each recommendation must be tied to what the user is doing right now, under 90 characters. Sample copy: "Claude can build the formulas right in your spreadsheet and clean up this forecast."
The parallel rule for third-party MCP partners (suggest_connectors) is the opposite—if the user hasn't named a provider, never pick one for them. "I need a ride" does not mean "I want to use [specific ride-hailing app]." Urgency is no exception: "I need a car in 20 minutes" still goes through the picker.
5. 24 Hours of Hardcore Testing
Within 24 hours of launch, beyond the prompt being laid bare across the web, hardcore demo after demo appeared:
Developers probed the capability ceiling from every angle; peers copied the rulebook note for note.
6. What's Truly Worth Reading Isn't the Rules—It's the Density of "Shall Not"
A production system prompt being exposed to the whole internet should be an incident. But reading to the end reveals: the most valuable part isn't any tool parameter—it's that long string of prohibitions. Don't quote one sentence too many, don't record one line too many, don't make one decision on the user's behalf.
Anthropic has designed Opus 5 as a "proactively defensive" product—30 tools give it the ability to act, but 34,000 tokens of rules make it decline almost everything before doing it. This design philosophy—greater capability, greater restriction—has been fully published, marking the first time the industry has seen the safety guardrails of a production AI system made transparent.
With Pliny also hosting the file on CL4R1T4S, more people will use this prompt for jailbreak and adversarial testing. A new round of jailbreak research targeting Opus 5's specific restrictions can be expected in August.
---
References