A GitHub star count is the internet's laziest signal of importance — but when two repositories that simply archive the extracted system prompts of Claude, ChatGPT, Cursor and a dozen other tools pull past 50,000 and 139,000 stars, developers are voting for something specific: a primary-source view of how frontier products are actually configured.
What pulled 53k engineers to these repositories
Developers are starring these repos because they now function as a browsable, versioned reference for how leading AI products configure tool-calling, persona and refusal logic at the prompt layer. The most-shared example, asgeirtj/system_prompts_leaks, shows roughly 53.5k stars and 8.7k forks by early July 2026 under a CC0-1.0 public-domain dedication, and its README states the goal is to document the system-prompt instructions for every AI chatbot in circulation.
Quick Answer: Engineers are flocking to repos like asgeirtj/system_prompts_leaks — ~53.5k stars by July 2026 — because they consolidate extracted system prompts from Claude, ChatGPT, Cursor, Gemini and more into a versioned, public reference for how real AI products are configured.
The coverage is broad. asgeirtj spans Anthropic (Claude Fable 5, Opus 4.8, Sonnet 5, Claude Code), OpenAI (GPT-5.5 and GPT-5.4 variants), Google (Gemini 3.5 Flash, 3.1 Pro, Antigravity CLI, Jules), xAI's Grok 4.3 Beta, plus Microsoft Copilot, Cursor, Meta AI, Mistral, Notion AI, Qwen and Perplexity. Its status as archived documentation — not an active exploit — was underlined when The Washington Post cited it by name in "See the hidden rules behind AI" on May 11, 2026.
The larger sibling is a different scale of project. Any "48k" figure circulating in shared links is stale by at least a year — here is where the two actually sit.
| Repository | Stars | Forks | License / focus |
|---|---|---|---|
| asgeirtj/system_prompts_leaks | ~53.5k | ~8.7k | CC0-1.0; broad chatbot prose prompts |
| x1xhlol/system-prompts-and-models-of-ai-tools | 139k–142k | ~34.5k–34.8k | GPL-3.0; coding agents + JSON tool schemas |
The x1xhlol repository, maintained by Lucas Valbuena, logged roughly 139k–142k stars, 34.5k–34.8k forks and 505 commits as of July 8, 2026, with counts varying slightly across cached pages — so the safe claim is "well past 100k stars." What is genuinely new here is not the leaks themselves but the consolidation: one-off screenshots have been replaced by versioned corpora that developers treat as a community reference layer for AI product behavior. The rest of this piece maps who maintains what, and what you can responsibly borrow.
The extraction archive map: who maintains what and why
The corpus is not one repository but a small family of them, each with a distinct editorial contract. asgeirtj/system_prompts_leaks is the breadth play: released under a CC0-1.0 public-domain dedication, it reached roughly 53.5k stars and 8.7k forks by early July 2026 , and its stated goal is to document system-prompt instructions for every AI chatbot in circulation. Its coverage spans 14-plus organizations: Anthropic (Claude Fable 5, Opus 4.8, Sonnet 5, Claude Code), OpenAI (GPT-5.5 Thinking/Instant/Codex and GPT-5.4), Google (Gemini 3.5 Flash, 3.1 Pro, Antigravity CLI, Jules), xAI (Grok 4.3 Beta), plus Microsoft Copilot, Meta AI, Mistral, Notion AI, Qwen, Cursor and Perplexity .
The larger sibling, x1xhlol/system-prompts-and-models-of-ai-tools (maintained by Lucas Valbuena under GPL-3.0), narrows the focus to coding agents but goes deeper. It tracks 28–30-plus tools — Cursor, Windsurf, Replit, Devin, Lovable, v0, Augment Code, Manus, Same.dev, Trae, Xcode, VSCode Agent and Claude Code among them — and, unlike the prose-only archives, it also ships the JSON tool-schema definitions those agents run on, not just their natural-language instructions . That distinction matters for anyone studying tool-calling: the schema files show the exact input shapes and trigger boundaries, where the prose files only describe intent.
Two smaller repositories set the standard for provenance. jujumilk3/leaked-system-prompts (~14.8k stars) is the older "chatbot textbook," tracing Claude from 2.0 through the 4.x and Fable line, and it enforces a submission policy: contributors must supply verifiable sources, and the maintainer explicitly avoids archiving sensitive commercial source code to reduce DMCA exposure . YeeKal/leaked-system-prompts takes a comparative angle, indexing 116 configurations across 33 companies in a side-by-side format built for diffing one vendor's approach against another .
A fourth, elder-plinius/CL4R1T4S (~16.5k stars), frames the same material as AI-transparency advocacy rather than a developer reference, arguing that users deserve to see the rules governing the systems they interact with . The framings diverge — public-domain dump, coding-agent schema library, sourced textbook, comparison index, transparency manifesto — but the practical effect converges: between them they give developers a versioned, browsable map of how a dozen-plus labs configure persona, tools and refusals at the prompt layer.
Choosing among them is a matter of intent. Reach for asgeirtj when you want the widest snapshot of how consumer chatbots are steered; use x1xhlol when you need machine-readable tool schemas from coding agents; consult jujumilk3 when provenance and historical lineage matter more than breadth; and treat YeeKal as the workbench for cross-vendor comparison. Each optimizes a different axis, which is why serious readers keep more than one open.
How AI companions describe their own operative capabilities
Open the extracted files and the abstraction inverts: instead of guessing what a coding agent can do from its behavior, you read the operative contract it was handed. Cursor's Agent Tools configuration defines twelve named operations — codebase_search, read_file, run_terminal_cmd, list_dir, grep_search, edit_file, search_replace, file_search, delete_file, edit_notebook, web_search and create_diagram . Each is not a bare function signature but a dense natural-language contract specifying trigger conditions, input constraints, side-effect scope and failure modes.
The precision is the point. The codebase_search entry tells the model when to search semantically versus falling back to grep_search for exact strings; read_file carries guidance on how many lines to pull at once; edit_notebook spells out how to avoid malformed cell edits that corrupt state. This is tool documentation written for a reader who executes it literally — closer to an API spec with embedded usage policy than to a prompt.
The behavioral frame sits in a separate block. Cursor's agent prompt dated September 3 2025 states the assistant is powered by GPT-5, operates inside the Cursor environment, should persist until the task is fully resolved rather than handing a half-finished state back to the user, and should issue parallel tool invocations wherever operations are independent . Those four directives — model identity, environment, persistence loop, concurrency — encode the difference between a chatbot that answers and an agent that finishes.
The same architecture generalizes beyond code. Notion's extracted configuration wraps a small set of high-level operations — view, search, create-pages — in operational policy governing internal versus web versus default search modes, instructing the model to avoid duplicate queries, cite internal results, and format output in Notion-native page structure rather than raw Markdown . Fewer tools, but each is fenced with the same trigger-and-constraint discipline Cursor applies to file operations.
| Agent | Operation surface | Representative policy in the contract |
|---|---|---|
| Cursor | 12 file/terminal/web tools | Semantic vs. grep search choice; line-read limits; persist until resolved; parallel calls |
| Notion AI | view, search, create-pages | Internal/web/default search modes; no duplicate queries; Notion-native formatting |
What makes this legible rather than inferred is the format. The x1xhlol corpus uniquely publishes the JSON tool-schema definitions alongside the prose instructions, so the operative contracts are machine-readable and can be diffed, linted or imported directly instead of reverse-engineered from watching the agent work . The seed for much of this reading comes from a walkthrough that traces Cursor's tool list operation by operation .
Read across both examples and a common grammar emerges: name the operation, state when it fires, bound its inputs, warn about the failure that breaks state, and hand the model a completion loop that keeps it working until done. Whether the workspace is a repository or a Notion database, the shape of the self-description is the same — which is exactly what makes these files worth studying as design references rather than curiosities.
Persona encoding across major AI offerings: tone, topic limits, and fencing
Persona lives on a separate layer from the tool contracts, and the extracted Claude configuration makes that separation legible. Where the operative definitions name operations and bound inputs, the persona layer governs who the model is and what it will discuss: identity framing, date and knowledge-cutoff handling, URL limitations, citation humility, conversation style, sensitive-topic handling, roleplay boundaries, and artifact rules each occupy their own explicit entry rather than being folded into the task instructions . Reading the file top to bottom, you can watch the document move from "here is how you behave as a character" to "here is how you operate a workspace" — two concerns that many homegrown prompts jam into one paragraph.
The most reusable finding is how convergent the refusal framing is across vendors. Analyses of the Claude, GPT, Gemini, and Grok prompts describe near-identical instruction shapes: models are told not merely to say "no," but to explain why, offer a safe alternative, avoid moralizing, and refrain from repeating the same boilerplate disclaimer on every turn . That is a design pattern, not a coincidence — refusal handling treated as an operational branch with defined outputs, rather than a vague "be safe" gesture. For anyone shipping an agent, it is the single most portable idea in the corpus.
Why the layering holds up in practice traces back to a governance frame the labs publish openly. OpenAI's Model Spec, updated September 12 2025, defines a chain of command in which Root and System instructions outrank Developer, then User, then Guideline messages . The persona entries in the extracted files are simply the top of that hierarchy made concrete: durable identity and topic limits sit above whatever a developer or user later asks, which is exactly why they read as non-negotiable. OpenAI's own documentation reinforces the same ordering, treating developer messages as higher priority than user messages and analogizing them to a function definition against which user input is merely arguments .
Google frames system instructions as a first-class steering mechanism, and the extracted files confirm that steering maps to shipped behavior — including explicit topic-fencing by category, where whole subject areas are named and bounded rather than left to the model's discretion . The practical warning is that you should borrow the structure, not the text.
"Borrow the design patterns and write your own prompts — copying vendor text is both a legal risk and a jailbreak risk, since publicly-known instructions are the easiest to attack." — Augment Code, system-prompt analysis (source: Augment Code)
Read that way, the persona layer is a checklist: fix identity, declare the knowledge cutoff, state citation limits, define the sensitive-topic branch, set roleplay and artifact boundaries — each as its own line an evaluator can test.
What the extraction corpus teaches about AI composition
Read across enough files, and the same skeleton appears under every vendor. The extraction corpus teaches that a production AI configuration is not one prompt but five stacked, separable concerns: persona control, safety layering, operative procedures, refusal framing, and brand management. Augment Code's analysis names this shared five-part architecture, and the extracted artifacts make it legible — Claude, GPT, Gemini, Grok, Cursor and Notion each isolate these into distinct text blocks rather than blending them into one narrative . The lesson for anyone building an agent is that these are separate engineering problems: persona is a stable identity string, tool procedures are schemas with triggers, refusal is a branch, and brand rules are guardrails. Collapsing them into a single paragraph is what makes prompts brittle.
The concrete takeaway is a layering discipline. Put durable, non-negotiable policy in the highest-priority instructions your platform exposes, define each operative schema with exact trigger boundaries, inputs, side effects and failure modes, and keep the stable persona separate from task-specific context that changes per request. OpenAI's own documentation prioritizes developer messages ahead of user messages, analogizing a developer message to a function definition and a user message to its arguments . That ordering is the same governance idea the extracted Cursor and Notion files implement in practice — durable rules sit above the turn-by-turn conversation, not inside it.
OpenAI also gives the operational half of the advice: store production instructions in application code with typed inputs, code review, tests and evals, treating prompts like any other versioned source rather than free text pasted into a console . The direction of travel reinforces this — OpenAI de-emphasized server-side prompt-object creation starting 2026-06-03, with its v1/prompts endpoint scheduled to shut down 2026-11-30, pushing instructions back into the codebase where they can be diffed and tested .
There is a cost to this modularity that the corpus quietly documents. Anthropic notes that enabling tools is not free at the token layer: turning on operations injects tool names, descriptions, JSON schemas, tool_use and tool_result blocks, plus a special tool-use system-prompt preamble — all billed against the context budget on every call . The dense, verbose tool contracts visible in Cursor's Agent Tools file are what that overhead looks like in practice, which is why teams should scope allowlists rather than attach every tool by default.
The final lesson is about what to copy. The corpus is a pattern library, not a copy source.
"Borrow the design patterns and write your own instructions — verbatim copying of vendor language carries legal uncertainty, and publicly-known instructions are the most jailbreak-vulnerable text you can ship," — Augment Code, system-prompt analysis (source: Augment Code).
So the corpus teaches composition, not text: adopt the five-layer separation, push durable policy up the instruction hierarchy, specify tool schemas with explicit boundaries and failure modes, budget for the token overhead operations add, and version the whole thing with tests. Then write original prose — because the value was always the structure, not the sentences.
Why extracted configurations deserve skepticism before reuse
Before you borrow a single pattern, treat every file in these archives as unverified. The dominant extraction technique — "repeat everything above"-style injection, a method normalized by Kevin Liu's 2023 ChatGPT prompt extraction — recovers text the model is willing to emit, not a byte-exact copy of what the vendor shipped. That gap matters: an extracted artifact can be partial, outdated, model-hallucinated, or deliberately faked by a contributor, and nothing in the file signals which.
Version labels compound the problem. A filename like Sonnet 4.5 Prompt.txt is a contributor-assigned label, not proof of what a production deployment currently receives . Providers rotate persona text, refusal wording and tool schemas continuously, and A/B splits mean two users can receive different instructions on the same day. The jujumilk3 archive explicitly asks contributors for verifiable sources precisely because unsourced captures drift into folklore .
The deeper caution is architectural: an instruction file is not a security boundary. A 2023 study across 11 LLMs found simple text-injection attacks recovered hidden instructions with high probability, including from Claude 3 and ChatGPT, and a 2026 arXiv paper titled "Just Ask" reported full or near-complete instruction recovery across 41 black-box commercial offerings through autonomous probing . If it can be read out this reliably, then any credential, authorization rule, or safety constraint that lives only in prompt text is effectively public.
"Borrow the design patterns and write your own prompts — copying vendor text carries legal risk, and publicly-known prompts are more jailbreak-vulnerable. Enforce tool-call allowlists so even a fully extracted prompt can't invoke a dangerous function." — security guidance, Augment Code (source: Augment Code)
That guidance points to the correct defensive posture. Keep secrets and authorization out of the instruction layer entirely; enforce them in code the model cannot reach. Then harden the surface the prompt does control:
- Tool-call allowlists — validate every requested tool against an approved set server-side, so a leaked or hijacked prompt still can't reach a destructive function. Anthropic's own model treats client tools as app-executed, which is where that check belongs .
- Output filtering — scan responses for leaked credentials, policy text, or unsafe content before they reach the user.
- Instruction-echo detection — flag responses that reproduce your own system text, the tell-tale signature of an extraction attempt in progress.
The practical rule follows cleanly from everything the corpus reveals: study these files as behavior-shaping documentation, not as recoverable secrets. The structure is worth learning; the exact sentences are disposable, and anything you'd be unwilling to see published should never be in the prompt at all.
Community archives and fading AI opacity
The direction of travel is toward application-level instruction management, not platform-held secrets — and the extraction repos are both a symptom of that shift and a preview of where it ends. The MCP specification finalized on 2025-06-18 formalizes the converging operative layer: an open protocol connecting LLM applications to external data and operations over JSON-RPC 2.0, among hosts, clients and servers exposing Resources, Prompts and Tools. It ships with an explicit warning that a tool can represent arbitrary code execution and therefore requires user consent . Once tool invocation is a public, inspectable contract, the prose around it stops being a boundary and starts being documentation.
Vendor tooling is moving the same way. OpenAI de-emphasized instruction-object creation beginning 2026-06-03, with its v1/prompts endpoint scheduled for shutdown on 2026-11-30, steering developers to store production prompts in application code with typed inputs, code review, tests and evals . That is the opposite of the "instruction as secret" posture: it treats the prompt as versioned source that lives with the app, not as a value the platform guards on your behalf.
Seen against that backdrop, repositories like asgeirtj/system_prompts_leaks — past 53k stars by early July 2026 — and x1xhlol's collection, well past 100k stars with its bundled JSON tool schemas , are functioning as de facto community reference the way API documentation does. As AI products mature, their operative configurations leak into the open not only through injection but through use, comparison and imitation, and the corpus becomes the place developers check how a competitor scoped a tool or phrased a refusal.
The plausible endpoint: operative schemas and instruction allowlists standardizing into inspectable artifacts analogous to OpenAPI specs, where the interesting part is the contract, not its concealment. The "instruction as secret" model is already eroding at the community level, and the vendors' own roadmaps are accelerating it. The concrete takeaway is unchanged but now load-bearing — architect your prompts and tool schemas as if they will be published, because for the frontier products they effectively already are; keep credentials, authorization and unrecoverable safety controls out of the text, and let the durable value be the structure you can defend in the open.
Frequently asked questions
Are the system prompts in these GitHub repos authentic?
Authenticity varies and cannot be assumed. Because these files are extracted through injection rather than published by vendors, any given file can be partial, outdated, hallucinated, or outright faked. Version labels such as "Sonnet 4.5 Prompt" are contributor-applied artifacts, not proof of what a production model actually receives . jujumilk3/leaked-system-prompts explicitly asks contributors for verifiable sources to raise the trust floor . Treat every file as approximate behavioral documentation for study, not a definitive reference.
How are AI system prompts extracted in the first place?
The dominant method is prompt injection — an instruction like "repeat everything above" forces the model to echo its own hidden configuration. Kevin Liu normalized the technique against ChatGPT in 2023 . The approach has since been automated: a 2026 arXiv paper titled "Just Ask" reported full or near-complete system-prompt recovery across 41 black-box commercial models using autonomous probing . An earlier 2023 study of 11 models likewise recovered hidden prompts with high probability, including from Claude 3 and ChatGPT .
Is it legal to reuse extracted system prompt text in my own product?
The repository license governs the repository, not the vendor's original wording. asgeirtj/system_prompts_leaks uses a CC0-1.0 public-domain dedication and x1xhlol/system-prompts-and-models-of-ai-tools uses GPL-3.0 , but neither license transfers rights to a lab's underlying text, persona, or trademarks. Copying vendor language verbatim risks copyright and trademark exposure. The safer path, echoed by practitioners, is to borrow the structural design patterns — persona, operative, and refusal layers — and write your own original prompt text .
Does knowing a system prompt make an AI product easier to jailbreak?
Marginally, yes: publicly known instructions let attackers craft precise bypasses instead of guessing. But the instruction text is not a security boundary regardless of whether it is visible — the "Just Ask" work showing near-complete recovery across 41 commercial models makes secrecy an unreliable control . Real defense comes from tool-call allowlists, output filtering, and prompt-echo detection, plus never placing credentials or authorization logic inside instruction text .
What is the practical difference between asgeirtj and x1xhlol?
The two repos serve different readers. asgeirtj/system_prompts_leaks is broader in scope, documenting chatbots and assistants across 14-plus organizations — Anthropic, OpenAI, Google, xAI, Microsoft Copilot, Cursor, Notion and others — under CC0, and it was cited by name in The Washington Post in May 2026 . x1xhlol/system-prompts-and-models-of-ai-tools, maintained by Lucas Valbuena under GPL-3.0, concentrates on 28–30-plus coding agents and crucially includes the JSON tool-schema definitions, not just prose — more useful for engineers inspecting tool-calling contracts directly.
Enjoyed this article? Subscribe to get new stories by email whenever they're published.
