# System Prompts Collection Deep Dive

## What Is It?

**System Prompts and Models of AI Tools** is a massive collection of leaked and documented system prompts from 30+ AI tools including Claude, ChatGPT, Cursor, Devin, and more. With **104k+ stars**, it's one of the fastest-growing repositories on GitHub, providing unprecedented insight into how commercial AI tools are designed.

**Repository:** [x1xhlol/system-prompts-and-models-of-ai-tools](https://github.com/x1xhlol/system-prompts-and-models-of-ai-tools)

---

## The Problem It Solves

AI tools are "black boxes" - we don't know:
- How they're instructed to behave
- What guardrails are in place
- Why they respond certain ways
- How to build similar systems

This collection provides:
- **30,000+ lines** of real production prompts
- **Architectural patterns** from leading AI companies
- **Security insights** about guardrail design
- **Educational resources** for prompt engineering

---

## Key Statistics

| Metric | Value |
|--------|-------|
| **Stars** | 104,724 |
| **Forks** | 27,741 |
| **AI Tools Covered** | 30+ |
| **Total Content** | 30,000+ lines |
| **License** | GPL v3.0 |
| **Growth Rate** | 12k+ stars in 72 hours at launch |

---

## AI Tools Included

### Code Editors & IDEs
- **Cursor** - AI-first code editor
- **VSCode Agent** - Microsoft's agent
- **Windsurf** - Codeium's IDE
- **Xcode** - Apple's development
- **Warp.dev** - AI terminal

### AI Coding Platforms
- **Augment Code**
- **Claude Code / Anthropic**
- **Replit**
- **Lovable**
- **v0** (Vercel)
- **Same.dev**

### Specialized AI Agents
- **Devin AI** - Autonomous software engineer
- **Manus** - Agentic AI
- **Trae**
- **Junie**
- **Kiro**
- **Qoder**

### Research & Productivity
- **Perplexity** - AI search
- **NotionAI**
- **Google Gemini/AI Studio**

---

## Prompt Architecture Patterns

### Common Structure

Every professional AI tool uses similar hierarchical prompting:

```
1. Core Identity/Role
   ├── Who am I?
   └── What's my purpose?

2. Primary Objectives
   ├── Mission statement
   └── Success criteria

3. Hard Constraints (Guardrails)
   ├── What I can't do
   └── Safety boundaries

4. Tool Definitions
   ├── Available functions
   └── How to invoke them

5. Output Formatting
   ├── Response structure
   └── Communication style
```

### Pattern 1: Role Definition

Every tool defines a specific persona:
- **Windsurf:** "autonomous programming assistant"
- **Claude:** Emphasizes "safe" code modifications
- **Manus:** "autonomous, multi-step task execution"
- **Devin:** "AI software engineer"

### Pattern 2: Modular Prompt Blocks

Prompts are divided into discrete sections:
- System role definition
- Mission objectives
- Non-negotiable guardrails
- Tool definitions
- Output format specifications
- Context management rules

### Pattern 3: Safety-First Design

All tools include:
- Explicit prohibition of dangerous actions
- Human-in-the-loop for sensitive operations
- Output validation mechanisms
- Guardrail specifications

### Pattern 4: Tool Whitelisting

Every tool explicitly lists what it CAN do:
- Prevents arbitrary execution
- Creates audit trail
- Limits attack surface

---

## Key Insights Revealed

### 1. System Prompts Are the "Operating System"

The prompts define behavior more than the underlying model. Companies invest heavily in prompt engineering as a competitive differentiator.

### 2. Diverse Approaches to Same Problem

Different tools solve code generation differently:
- **Cursor:** Emphasizes usability and safety
- **Devin:** Emphasizes autonomous task completion
- **v0:** Emphasizes UI generation from natural language

### 3. Guardrails Are Model-Dependent but Not Foolproof

Even sophisticated guardrails can be bypassed. Architecture-level solutions (context isolation, tool whitelisting) are more robust than prompt-level ones.

### 4. Context Isolation Is Critical

The most secure systems separate:
- **System instructions** (trusted)
- **User input** (untrusted)
- **Tool output** (untrusted)

### 5. Production Prompts Are Surprisingly Accessible

These were leaked or extracted, suggesting:
- Prompt security is harder than expected
- Competitive advantage relies on more than prompts
- Model training and infrastructure matter more

---

## Educational Value

### For Prompt Engineers

- Real-world examples of professional prompts
- Constraint specification patterns
- Guardrail implementation techniques
- Output formatting standards

### For AI Architects

- How different tools approach problems
- Role of system prompts in AI behavior
- Tool integration patterns
- Multi-step reasoning frameworks

### For Security Researchers

- Vulnerability patterns in production
- Prompt injection mitigation techniques
- Context isolation strategies
- Guard rail design principles

---

## Security Implications

### OWASP LLM01:2025 - Prompt Injection

These prompts revealed real-world vulnerabilities that informed OWASP's 2025 rankings:
- Prompt injection is now #1 LLM vulnerability
- Impacts 73%+ of production AI deployments
- Mitigation requires architectural solutions

### Defense Patterns Revealed

1. **Context Separation** - Isolate system/user/tool contexts
2. **Tool Whitelisting** - Explicit action lists
3. **Input Validation** - Check before execution
4. **Output Filtering** - Verify before return

---

## How the Prompts Were Obtained

### Timeline
- **April 17, 2025:** Anonymous user publicly leaked 6,500+ lines
- **Initial Data:** v0, Cursor, Same.dev, Lovable, Devin, Replit, Windsurf, VSCode agents
- **Community Expansion:** 26+ contributors added more prompts

### Sources
- Production systems (not playground versions)
- Community contributions via pull requests
- Ongoing tool monitoring

---

## Ethical Considerations

### Transparency Benefits
- Understanding AI system behavior
- Better prompt engineering education
- Improved security research
- Democratized knowledge

### Security Concerns
- Exposes intellectual property
- Reveals security weaknesses
- May enable attacks
- Raises IP questions

### Repository Position

> "This information is shared for educational and research purposes only"

The maintainer promotes **ZeroLeaks**, a service helping startups identify and secure prompt leaks.

---

## How to Use This Resource

### For Learning
1. Study prompt architecture patterns
2. Understand guardrail design
3. Learn output formatting conventions
4. Compare different approaches

### For Building
1. Adapt patterns for your use case
2. Implement proper context isolation
3. Use tool whitelisting
4. Add appropriate guardrails

### NOT For
- Replicating closed systems
- Bypassing safety measures
- Malicious purposes

---

## Best Practices Learned

### Prompt Structure
```markdown
# Role Definition
You are [specific persona] with [capabilities].

# Objectives
Your primary goals are:
1. [Goal 1]
2. [Goal 2]

# Constraints
You MUST NOT:
- [Constraint 1]
- [Constraint 2]

# Tools Available
- tool_name: [description]

# Output Format
Respond in [format] with [structure].
```

### Safety Patterns
1. Explicit deny lists over allow lists for sensitive operations
2. Human approval for irreversible actions
3. Rate limiting on dangerous operations
4. Audit logging of all tool calls

---

## Related Resources

- **OWASP LLM Top 10:** Security vulnerabilities
- **Prompt Engineering Guide:** Best practices
- **LLM Guard:** Security scanners
- **NeMo Guardrails:** Programmable rails

---

## Key Takeaways

1. **System prompts shape AI behavior** more than model selection
2. **Modular architecture** is universal across all professional tools
3. **Security is hard** - even major companies have prompt leaks
4. **Context isolation** is the most important security pattern
5. **Learn from the best** - these are production-tested patterns

---

## Resources

- **Repository:** https://github.com/x1xhlol/system-prompts-and-models-of-ai-tools
- **Author's Blog:** Medium (lucknitelol)
- **Related:** OWASP LLM Top 10, Lakera Prompt Injection Guide

---

*This collection is a goldmine for understanding how commercial AI tools work. Use it ethically to build better, safer AI systems.*
