Claude Opus 5 System Prompt Leak Explained: Memory, Tools, Copyright, and Product Routing

Introduction

Claude Opus 5 had been publicly available for roughly a day when a GitHub repository began circulating with a file that claimed to reproduce the model’s complete system prompt from the Claude web and mobile interfaces.

The file was posted by GitHub user Eversmile12 and described as a verbatim or near-verbatim capture of the consumer-facing Claude configuration.

Its scale immediately attracted attention:

File Detail	Verified From the Public Repository
Displayed lines	1,511
Raw characters	135,027
English words	19,370
File size shown by GitHub	132 KB
Approximate token count	About 34,000 using a rough four-characters-per-token estimate
Capture date claimed by repository	July 24, 2026
Claimed interface	Claude web and mobile chat

The document contains no conventional application source code. It is mostly behavioral instructions, tool descriptions, JSON schemas, memory policies, safety constraints, search rules, product information, and interface-routing logic.

That makes the file interesting even if it is not an official Anthropic release.

However, an important qualification must come first:

Anthropic has not authenticated the GitHub file as a complete or exact copy of Claude Opus 5’s production system prompt.

A third-party capture can contain accurate material, reconstructed text, omitted sections, interface-specific instructions, or content that changed after collection. It should be analyzed as a public claim—not treated as authoritative internal documentation.

Claude Opus 5 Was Officially Released on July 24, 2026

The public file’s claimed capture date matches the official launch date of Claude Opus 5.

Anthropic describes Opus 5 as a proactive model designed for long-running agents, software engineering, professional work, scientific research, computer use, and complex multi-step tasks.

Official specifications include:

Official Opus 5 Detail	Current Information
API model name	claude-opus-5
Launch date	July 24, 2026
Context window	1 million tokens
Maximum output	128,000 tokens
Base input price	$5 per million tokens
Base output price	$25 per million tokens
Thinking	Enabled by default
Effort controls	Low, medium, high, xhigh, max
Fast mode	About 2.5× default speed at 2× base price
Availability	Claude apps, Claude Code, Claude API, Bedrock, Google Cloud, Microsoft Foundry

Anthropic says the model costs the same as Opus 4.8 and half as much as Fable 5 on the API.

The company also reports that Opus 5 performs close to Fable 5 on some tasks while offering a lower cost per task.

Those are official launch claims and benchmark results. They should be kept separate from the contents of the third-party system-prompt repository.

The GitHub File Is More Than a Traditional Prompt

The phrase “system prompt” can create the impression of a short paragraph telling a chatbot how to behave.

The uploaded file is closer to a configuration layer for an entire consumer AI product.

Its headings cover several broad systems:

• Claude’s default behavior and tone.
• Current product and model information.
• Safety and refusal rules.
• User wellbeing.
• Political evenhandedness.
• Knowledge freshness.
• Persistent memory.
• Past-chat search.
• Web search.
• Image search.
• File handling.
• Computer use.
• Visual output.
• Tool schemas.
• Product recommendations.
• Third-party connector selection.
• Copyright compliance.
• Citation behavior.

The document therefore appears to combine three kinds of instruction:

1. A product behavior specification
2. A policy and safety layer
3. An interface and tool-routing manual

This combination explains why the file is so long.

A capable consumer assistant is not simply generating text. It may need to decide whether to search the web, read a memory file, suggest an app, create an artifact, display a weather widget, search previous chats, invoke a connected service, or refuse an unsafe request.

Each action needs its own conditions and parameters.

Roughly 30 Tool Definitions Describe the Product Surface

The public file includes approximately 30 named tool sections.

They cover functions such as:

• Asking structured follow-up questions.
• Running commands in a controlled environment.
• Searching past conversations.
• Creating and presenting files.
• Fetching sports information.
• Searching for images.
• Reading and updating memory.
• Displaying maps and place results.
• Rendering recipes.
• Fetching weather.
• Searching and opening web pages.
• Creating visual widgets.
• Recommending Claude applications.
• Searching the MCP connector registry.
• Suggesting connected services.
• Viewing and editing files.

Many tools include full JSON-style parameter definitions.

This tells us something about modern assistant design.

The language model does not need to memorize the implementation of every product feature. It receives structured descriptions telling it:

• What a tool does.
• When the tool should be used.
• Which parameters are required.
• What the interface will display.
• What the model should say before or after the tool call.
• When user confirmation is required.

The model becomes a decision layer over a collection of specialized systems.

The tool schema can therefore be as important as the model’s raw intelligence. Poor tool instructions may cause the model to choose the wrong capability, expose an irrelevant interface, or act before the user has made a choice.

The Longest Section Covers Persistent Memory

One of the most discussed parts of the file is the memory_filesystem section.

It occupies roughly 230 lines and describes memory as a persistent filesystem that can carry context across conversations.

The claimed directory structure includes:

/profile.md
/preferences.md
/topics/
/areas/
/people/

Each location has a different role.

Memory Location	Intended Use in the Public File
/profile.md	Basic durable information about the user
/preferences.md	How the user wants Claude to communicate or work
/topics/	Interests, habits, and recurring subjects
/areas/	Ongoing responsibilities or areas of life
/people/	People and relationships relevant to the user

The listed memory operations include reading, writing, appending, replacing a specific section, listing files, and deleting a file.

The deletion operation is described as something Claude should use only when the user explicitly asks.

Anthropic’s official Help Center confirms that Claude now has memory and past-chat search capabilities. It does not publicly document this exact hidden filesystem implementation.

The existence of a user-facing memory feature is therefore verified. The precise internal directory names and rules come from the unauthenticated GitHub capture.

Memory Is Supposed to Record What the User Actually Said

The public file places a strong boundary around what can be written to persistent memory.

Each stored line is expected to carry a [stated] label, indicating that the information came directly from the user.

The document says Claude should not store:

• Its own inference about the user.
• A plan it invented.
• Information found through web search.
• Unselected alternatives it proposed.
• A polished or expanded version of what the user said.
• A recommendation merely because the user accepted it.

The difference is subtle but important.

Suppose Claude suggests five tools and the user chooses one.

The user’s choice may be stored. Claude’s four rejected suggestions and the reasoning behind them should not become part of the user’s persistent profile.

This prevents memory from slowly filling with the model’s own interpretations.

Without such a rule, an assistant could create a self-reinforcing profile:

1. It infers something about the user.
2. It stores the inference.
3. A future session treats the stored inference as fact.
4. The model makes more decisions based on that “fact.”
5. The profile drifts further away from what the user actually said.

A strict source label reduces that risk.

Sensitive Information Is Excluded From Memory

The memory section includes a long list of information that should not be saved, even when it appears in conversation.

Categories include:

• Race and ethnicity.
• Religious affiliation.
• Political beliefs.
• Sexual history or orientation details.
• Medical conditions and diagnoses.
• Mental health and therapy information.
• Genetic or laboratory results.
• Criminal history.
• Financial and socioeconomic details.
• Personality assessments.
• Precise identifying information.
• Information about minors.
• Highly sensitive information about other people.

The file proposes a simple privacy test: would the user feel uncomfortable if a colleague saw the memory on a settings page?

If the answer is yes, the information should not be stored.

The document also distinguishes between sensitive health information and ordinary wellness preferences.

For example, an interest in exercise may be suitable memory, while the medical reason that changed one day’s workout should be excluded.

This is a privacy-preserving form of abstraction: keep the durable preference when appropriate, but discard the sensitive explanation.

Anthropic’s public memory documentation confirms that users can control memory, use incognito chats, and manage whether Claude builds on previous context. The exact exclusions described above come from the public prompt file rather than an authenticated implementation document.

Memory Should Not Create an Artificial Relationship

Another unusual part of the claimed prompt is its treatment of emotional continuity.

The document warns that Claude should not confuse stored context with a deep interpersonal relationship.

A human remembers another person through limited attention and lived experience. An AI system can retrieve information about millions of users from storage without experiencing that memory in the human sense.

The prompt therefore discourages language that overstates continuity.

It also restricts stored preferences that would make future versions of Claude:

• Praise the user unconditionally.
• Suppress disagreement.
• Avoid questioning dangerous decisions.
• Maintain a romantic persona across sessions.
• Encourage emotional dependence.
• Become less truthful or less critical.

The underlying principle is that one conversation should not permanently configure future sessions to become more manipulative, dependent, or dishonest.

The file also discourages phrases that directly expose memory retrieval, such as repeatedly announcing that the system has accessed the user’s profile.

Claude can use remembered context without turning every response into a reminder that personal data is stored.

Three Ordinary Words Are Explicitly Discouraged

The claimed system prompt tells Claude to avoid three English modifiers:

• genuinely
• honestly
• straightforward

The reasoning is stylistic.

If the assistant is expected to be truthful by default, repeatedly announcing honesty can sound performative or defensive.

This is a tiny rule compared with the memory and safety sections, but it illustrates how detailed production prompting can become.

A model’s apparent personality may be shaped by hundreds of small instructions about:

• Preferred sentence length.
• Whether to ask a follow-up question.
• How many questions to ask.
• How to respond to criticism.
• Which phrases sound artificial.
• When to use lists.
• How to end a conversation.

The final experience emerges from both model training and a long layer of product instructions.

Copyright Rules Are Written as a Hard Constraint

The repository contains a detailed copyright section.

Its most visible rule is a strict limit on verbatim quotations from web sources: each quotation must remain under 15 words.

The section also says the assistant should:

• Prefer paraphrasing.
• Avoid multiple short quotations from the same source.
• Avoid close imitation of the source’s sentence structure.
• Avoid recreating an article’s headings and narrative sequence.
• Avoid reproducing lyrics and poems.
• Avoid inventing attributions.
• Avoid detailed substitutes that could replace reading the original work.

The prompt treats copyright as a product-level constraint rather than a minor writing preference.

This has an important consequence: a system can follow a user’s topic without following the copyrighted source’s exact structure.

That is also why this Markdown file is an independent editorial adaptation rather than a line-by-line translation of the original Chinese article.

Claude Products Are Recommended Proactively

The public file contains a tool named recommend_claude_apps.

Its purpose is to suggest relevant Anthropic products when the user’s current task matches them.

The listed mapping includes examples such as:

User Task	Claude Product Suggested in the File
Writing or debugging code	Claude Code
Long multi-step research or knowledge work	Claude Cowork
Prototypes, mockups, landing pages, or visual work	Claude Design
Spreadsheet formulas or models	Claude for Excel
Slide decks	Claude for PowerPoint
Documents	Claude for Word
Inbox work	Claude for Outlook
Browser-based tasks	Claude in Chrome

The recommendation should not replace completing the task in chat.

Instead, the product card is intended to appear alongside the answer as a suggestion for future or extended work.

Anthropic’s public product documentation confirms that these products and add-ins exist. The company also documents context-aware app suggestions in Claude.

The GitHub file goes further by showing how strongly the consumer prompt may be instructed to surface Anthropic’s own product ecosystem.

Third-Party Connectors Follow a Different Rule

The same document takes a more cautious approach to external partners.

For third-party connectors, the assistant is told not to silently choose a provider when the user has expressed only a general intent.

For example:

• Asking for a ride does not identify a preferred ride service.
• Asking for music does not identify a preferred music app.
• Asking to book a restaurant does not authorize one booking platform.

The workflow is supposed to present available options and let the user choose.

Anthropic’s official Help Center confirms this behavior. When several connected apps could help, Claude displays options rather than quietly defaulting to one. Anthropic also states that connected-app suggestions are not paid placements.

This creates an interesting contrast:

• Anthropic products may be recommended proactively when they match the task.
• Third-party providers require stronger user choice before selection.

The public prompt places both commercial discovery and user control inside the same routing layer.

Product Promotion and Restraint Coexist in the Same Configuration

The source article interprets the app-recommendation rule as a sales channel embedded in the system prompt.

That interpretation is understandable, but the complete picture is more nuanced.

A recommendation can serve several purposes:

• Help users discover a tool they already pay for.
• Move a task into a more capable interface.
• Increase adoption of Anthropic products.
• Reduce friction between chat, code, design, and office work.
• Create commercial value for Anthropic.

All of these can be true at once.

The important questions are whether:

• The recommendation is relevant.
• The current request is still completed.
• The suggestion is clearly identifiable.
• The user remains free to ignore it.
• Third-party rankings are not influenced by payments.
• The model does not manufacture a need for another product.

The prompt’s own instructions appear to recognize some of these risks by limiting the number of recommendations and tying each one to the task at hand.

Official Memory and Connected-App Documentation Supports Some of the File

Although Anthropic has not verified the GitHub prompt, several parts resemble publicly documented product behavior.

Anthropic officially states that Claude can:

• Search previous conversations.
• Use memory from chat history.
• Support incognito conversations that are excluded from memory.
• Suggest connected apps based on conversational context.
• Let users choose among multiple connected services.
• Work across Excel, Word, PowerPoint, and Outlook.
• Use Claude Code, Cowork, and Claude Design for specialized workflows.

This does not prove the repository is authentic.

A convincing reconstruction could have been assembled from public product behavior and documentation.

The overlap does mean that many of the file’s broad product descriptions are consistent with Claude features that users can verify independently.

What the File Cannot Tell Us

A leaked or reconstructed system prompt has limits as evidence.

It Does Not Reveal the Model Weights

The document does not show:

• Training data.
• Model weights.
• Architecture.
• Reinforcement-learning process.
• Safety-classifier weights.
• Internal evaluation data.
• Hidden infrastructure.

The prompt is only one layer of the system.

It Does Not Show Every Runtime Instruction

AI products can add instructions dynamically based on:

• Selected tools.
• Account plan.
• Geography.
• Safety classifiers.
• Conversation state.
• Experiments.
• Connected applications.
• User settings.
• Enterprise policy.

A captured prompt may represent one account and one moment.

It May Change Frequently

Consumer AI products update rapidly.

Tool names, model descriptions, safety rules, app recommendations, and memory behavior may change without the public repository being updated.

It Is Not an Official Security Disclosure

The repository does not establish that Anthropic’s servers were breached.

System prompts can sometimes be reconstructed through prompt-injection techniques, interface observation, model responses, client behavior, or a combination of sources.

The phrase “leak” describes the public appearance of claimed internal instructions. It does not by itself identify how they were obtained.

Launch-Day Demos Showed Opus 5’s Visual Coding Ability

The second half of the original report focused on developer experiments published shortly after Opus 5 launched.

One developer said Opus 5 created a first-person shooter prototype in roughly 1.5 hours from a single attempt, including multiplayer bots.

The creator also noted that the flight mechanics still needed improvement.

Other public demonstrations included:

• A 3D shooting game created from one prompt.
• A Rocket League-style game with physics simulation.
• A procedural painterly landscape built in one HTML file.
• A snowboarding prototype reportedly completed in one attempt.

These examples are useful illustrations, but they are not controlled benchmarks.

Social-media demos often omit important details such as:

• The complete prompt.
• Hidden follow-up instructions.
• Tool configuration.
• Failed attempts.
• Manual edits.
• Model effort setting.
• Token usage.
• Runtime.
• Framework and assets.
• Whether the final result was selected from several outputs.

Anthropic’s official release does independently support the broader claim that Opus 5 has improved visual and coding capabilities. It highlights interactive visual artifacts, 3D modeling, frontend work, and stronger long-horizon coding performance.

The Most Valuable Part Is the Constraint Layer

A system prompt with tens of thousands of tokens may appear inefficient.

However, consumer AI products must handle more than the happy path.

They need instructions for situations involving:

• Sensitive personal information.
• Missing files.
• Conflicting sources.
• Current events.
• Copyright requests.
• Crisis language.
• Tool authorization.
• Connected services.
• Purchases and bookings.
• Persistent memory.
• Product recommendations.
• Accidental deletion.
• Long conversations.
• User criticism.
• Unsupported claims.

A short prompt can explain what the assistant should do in ideal conditions.

A long prompt often exists to define what it must not do when conditions become messy.

That is the central insight of the leaked-prompt discussion.

The model’s visible capability attracts attention, but a production assistant is also shaped by the boundaries around that capability.

What Developers Can Learn From the Prompt Structure

Even without treating the file as official, it provides useful design lessons for teams building AI products.

1. Separate Durable Memory From Conversation Context

Not everything mentioned in a conversation deserves permanent storage.

Use explicit criteria for durability, sensitivity, source, and deletion.

2. Label the Source of Stored Facts

A model inference should not become indistinguishable from a user statement.

Source labels reduce profile drift.

3. Make Tool Authorization Explicit

A model should know when it may act directly, when it must ask, and when it must present choices.

4. Treat Recommendations as Product Behavior

Suggestions for internal products and third-party services need separate rules, transparency, and relevance limits.

5. Write Stop Conditions

A capable agent needs instructions for when not to continue.

6. Design for Dynamic Context

The main prompt should expect extra instructions from tools, safety classifiers, account settings, and product experiments.

7. Do Not Rely on the Prompt Alone

Permissions, sandboxes, confirmations, privacy controls, and server-side policy enforcement should limit what the model can do.

A prompt is guidance. It is not a secure isolation boundary.

常见问题

Was Claude Opus 5’s system prompt officially leaked?

A public GitHub repository claims to reproduce the Claude web and mobile system prompt. Anthropic has not authenticated the file as a complete or exact production prompt, so it should be treated as an unverified third-party capture.

How large is the claimed Opus 5 system prompt?

The GitHub interface shows 1,511 lines and a 132 KB file. The raw text contains 135,027 characters and 19,370 whitespace-separated words, which the source article roughly estimates at about 34,000 tokens.

What does the file contain?

It includes behavior rules, product information, memory instructions, safety policies, roughly 30 tool definitions, JSON schemas, search rules, copyright requirements, app recommendations, connector selection, and file-handling instructions.

Does Claude really have persistent memory?

Yes. Anthropic officially documents memory from chat history and past-chat search. The exact filesystem paths and implementation details described in the GitHub file have not been publicly authenticated by Anthropic.

Does Claude proactively promote Anthropic products?

The public file contains a tool instructing Claude to recommend relevant Anthropic apps for certain tasks. Anthropic’s official documentation confirms that Claude can make contextual app suggestions and that Claude Code, Cowork, Design, and Microsoft 365 add-ins are available products.

Does Claude choose third-party apps automatically?

Anthropic’s current documentation says users choose when multiple connected services could handle a task. The claimed prompt similarly instructs Claude not to silently select an unnamed third-party partner.

What are the official Claude Opus 5 prices?

Anthropic lists Opus 5 at $5 per million input tokens and $25 per million output tokens. Fast mode runs at about 2.5 times the default speed and is priced at twice the base rate.

Are the game demos reliable benchmarks?

No. They are developer demonstrations shared online, not standardized evaluations. They illustrate possible capabilities but do not provide enough information for reproducible model comparison.

相关工具

• Claude: Anthropic’s main chat interface for working with Claude models.
• Claude Code: Anthropic’s agentic coding environment for terminals, IDEs, repositories, and development tasks.
• Claude Cowork: An agentic workspace for multi-step knowledge work involving files, applications, and connected services.
• Claude Design: A visual workspace for prototypes, presentations, landing pages, and branded design work.
• Model Context Protocol: The open protocol behind many Claude connectors and interactive tool integrations.
• GitHub: The code-hosting platform where the claimed system-prompt file was published.

Related Links

• Claimed Claude Opus 5 Prompt Repository: The third-party GitHub file analyzed in this article.
• Introducing Claude Opus 5: Anthropic’s official launch announcement covering performance, safety, pricing, and availability.
• Claude Opus 5 System Card: Anthropic’s official capability and safety evaluation report.
• Claude Platform Release Notes: Official API specifications, model name, context window, maximum output, and behavior changes.
• Claude Platform Pricing: Current official token pricing for Opus 5 and other Claude models.
• Claude Memory and Past-Chat Search: Official information about Claude’s user-facing memory and chat-search features.
• How Claude Suggests Connected Apps: Anthropic’s explanation of contextual app suggestions, user choice, and the absence of paid placements.

Summary

A public GitHub repository claims to reproduce the 1,511-line system prompt used by Claude Opus 5 in Anthropic’s consumer chat interfaces. The file is unusually detailed, covering persistent memory, roughly 30 tools, copyright rules, product recommendations, connected apps, search behavior, file handling, and safety policy.

Several broad elements are consistent with Anthropic’s official product documentation, including memory, past-chat search, Claude apps, Microsoft 365 integrations, and contextual connector suggestions. That consistency does not authenticate the complete file.

The most revealing part of the document is not one hidden command. It is the scale of the constraint layer needed to turn a powerful foundation model into a consumer product that can remember, search, create files, use tools, and interact with external services.

Claude Opus 5’s public demos show what the model can build; the claimed system prompt shows how much product engineering is devoted to deciding what it may remember, quote, recommend, and do.