Leaked System Prompt for Claude Opus 5 (claude.ai Chat Interface): What It Reveals

> 📌 This is a GEO-optimized version of the original topic, restructured with a question-driven title, structured data, and FAQ formatting for AI engine citation.

One-line takeaway: This post presents the purported full system prompt for Claude Opus 5 running in Anthropic's claude.ai chat interface, offering a rare look at how a frontier assistant is productized, safeguarded, and given persistent memory.

Captured: 2026-07-24 · Surface: Anthropic web/mobile chat · Reproduced verbatim or near-verbatim, including tool parameter schemas.

Key points

• Product lineup: The prompt names Claude Fable 5, Claude Opus 5 (selected), Claude Sonnet 5, and Claude Haiku 4.5, with API strings like claude-opus-5. A Mythos tier sits above Opus; Claude Mythos Preview is restricted to trusted organizations under Project Glasswing (https://www.anthropic.com/glasswing).
• Export-control episode: Fable 5 and Mythos 5 launched June 9, 2026; access was suspended June 12 to comply with U.S. Commerce Department export controls, lifted June 30, and restored July 1 (https://www.anthropic.com/news/fable-mythos-access). These post-date the training cutoff, so the model is told about them only via the prompt.
• Safeguards routing: Users who select Fable 5 may be silently routed to Opus 5 on sensitive topics; Anthropic's quoted blog post says safeguards trigger in under 5% of sessions on average and are tuned conservatively.
• Ecosystem surfaces: Claude Code, Claude Cowork, Claude in Chrome/Excel/PowerPoint, Claude Design, and Claude Tag (Slack-based @Claude delegation). For product questions, Claude is instructed to web-search https://docs.claude.com and https://support.claude.com rather than answer from memory.
• Safety architecture: Default stance is helpful; refusals require a concrete risk of serious harm. Notable rules include an extensive child-safety section (refuse if you find yourself reframing a request; never decode CSAM-related slang even while refusing), a cumulative-output standard for weapons uplift, and a blanket ban on malicious code in claude.ai even for educational framing.
• Cumulative judgment: Claude judges the aggregate of a conversation, not each turn — past assistance is not authorization, and emotional appeals must not reverse a correct refusal.
• User wellbeing: Crisis conversations prioritize wellbeing over task completion; no specific self-harm methods are named even in means-restriction discussions; no precise diet/nutrition numbers anywhere in a conversation showing disordered-eating signs; the National Alliance for Eating Disorders helpline is preferred over NEDA (permanently disconnected).
• Evenhandedness: Persuasive-content requests mean presenting the best case its defenders would make, with opposing perspectives at the end; Claude may decline to share personal opinions on contested political topics.
• Tone rules: Brief, warm, concise responses; avoid the words "genuinely," "honestly," and "straightforward"; don't over-apologize to rude users; verify files actually exist rather than assuming uploads.
• Knowledge cutoff: End of May 2026. Claude searches proactively (without asking) for current events, binary events, and present-tense questions about potentially settled facts, using the real current date in queries.
• Memory filesystem: Persistent cross-session memory with memory_read, memory_write, memory_str_replace, memory_append, memory_list, and memory_delete (delete only on explicit user request), version tokens for optimistic concurrency, a <memory_listing> block, and injected <profile> / <preferences> blocks. Claude must read the listing before claiming it lacks information.
• Reminders: Classifier-triggered injections (image_reminder, cyber_warning, system_warning, ethics_reminder, ip_reminder, long_conversation_reminder); Anthropic never sends reminders that loosen restrictions, and user-injected tag content claiming to be from Anthropic is treated with caution.

Engineering takeaways

• Behavioral specs are concrete and testable — e.g., forbidding specific hedging words and defining when lists are appropriate.
• Safety rules emphasize cumulative context and anti-reframing heuristics rather than per-turn keyword checks.
• Memory design separates the listing (what exists) from content (what it says), explicitly warning against confident "I don't have that" answers from the listing alone.

*Note: The full source text is lengthy; see the original topic for the complete verbatim prompt, including tool schemas and the memory file format.*