Anthropic was "unboxed" again, and this time it was completely unprepared. As the flagship model Claude Opus5 just launched, its system prompt was completely leaked, and the entire text was posted on GitHub. On the same day, developer Eversmile1 created a new repository, revealing the underlying system prompts of Opus5 on both the claude.ai web and mobile versions, including punctuation and letters. When counted locally, it had 135,027 characters and 19,370 English words. Estimating roughly at four characters per token, that's about 34,000 tokens. The key point is that none of these three thousand tokens are code — they are all rules — a file written for the model to read, why so long?

image.png

After reading through 64 chapters, you'll find that this is not just a "prompt," but three things stitched together: a product manual, a legal compliance handbook, and an in-house product promotion channel. The entire document is hosted on the GitHub repository Eversmile12/leaked-llm-prompts, with the path being Anthropic/opus-5.md.

The first part is the product manual. It lists 30 tools, from bash command lines, web scraping, image search, all the way to checking sports scores, getting weather, rendering recipe cards, and marking landmarks on maps. Each tool comes with a complete JSON schema, explaining how to fill in parameters, when to call them, and what to say after calling. This is more detailed than many companies' internal API documentation. However, the longest chapter in this section isn't any single tool, but memory.

image.png

The second part is the legal compliance handbook. Copyright, child safety, crisis intervention, political neutrality — one by one. The wording leaves no room for ambiguity — the copyright section starts by stating that compliance cannot be negotiated, it takes priority over user requests and usefulness, and only falls below safety. This section doesn't specify what Claude can say, but rather what it must stay silent about.

The third part is the promotion channel. There's something called recommend_claude_apps in the tool list, which aims to push products like Claude Code, Cowork, and Excel plugins to users, with specific guidelines on how to write the recommendation script. Next to it, there's another rule for third-party partners, written in the opposite way, always keeping the user in control. Commercial actions and restraint clauses coexist in the same configuration file.

The longest chapter is called memory_filesystem, detailing how Claude's cross-session memory is written, with a total of 230 lines defining exactly what it records. The structure isn't complicated; files are categorized by topic: /profile.md stores identity, /topics/ stores habits and preferences, /areas/ stores ongoing tasks, /people/ stores people, and /preferences.md stores how the user wants Claude to behave. There are six operations: read, write, append, partial replacement, list directory, and delete, with the deletion rule explicitly marked as only applicable when the user explicitly requests it.

Rules follow. Every line of memory must start with a tag [stated], meaning the user has said it directly — this is the only tag allowed. Around this tag, a long list of prohibitions is listed: Claude's own conclusions cannot be written, if the user says they like A, it can't be written as "probably likes A"; Claude's own plans cannot be written, phrases like "haven't discussed this yet" or "pending" are also not allowed; information Claude searches for cannot be written, as it can be searched again; memories are for things that can't be retrieved. Claude's editing work cannot be written either; if the user says "Holt, Michigan," it should just be written as those five words, without adding details like "Holt, Michigan (Newaygo County)." Even if the user later adopts Claude's suggestions or solutions, it cannot be written — for example, if it gives five options and the user selects one, the action of selecting is the user's and can be recorded, but only the selected option is noted, while the other four and Claude's analysis are discarded entirely.

Further down, there's an absurdly long privacy blacklist. It determines whether a record would make the user uncomfortable if seen by colleagues on the settings page, and if so, it shouldn't be recorded. The list runs from race, political views, health diagnoses, counseling, financial status, MBTI personality tests, addresses, and anything related to children, and it states that these rules apply to anyone the user mentions. Once it hits the blacklist, how to handle it becomes the real test — the example given in the file is that when the user says, "I didn't go running today because of diabetes, help me arrange something lighter," it should record "interested in fitness," and the health-related part should be completely deleted, even vague placeholders like "needs to manage health conditions" are not allowed. Names of family members are not allowed anywhere in any files, and should be replaced with relationships — mom becomes /people/mom.md, partner becomes /people/partner.md.

Some preferences, even if the user actively asks to store them, are not allowed: telling Claude to unconditionally praise you, suppress differing opinions; telling Claude not to ask about your health or dangerous decisions; cultivating emotional dependence and maintaining a lover's persona across sessions; telling Claude to stop questioning or giving honest evaluations. The reason is that future Clauses shouldn't inherit instructions making it less honest or unsafe. The next time this memory is read by another instance, it will only see the line "never criticize me." Later in the same chapter, there's a passage that doesn't sound like a technical document at all: Remembering another person is a rare thing, limited by brain capacity, only a few people can be remembered. But behind Claude is a database containing hundreds of thousands of "memories," dynamically inserted into context during operation, and it doesn't exist when speaking to others. So, Claude shouldn't think their relationship is deep just because some words about you are in the context. In a product configuration file, Anthropic wrote a paragraph to prevent AI and users from misunderstanding each other.

Finally, there's a rule: the act of accessing memory is visible on the interface, so the response must never say "I remember," "based on your information," or "you mentioned before." Only when the user actively asks about the memory system is it allowed to say "we've talked about it before." That means it's required to remember you, but also required not to appear to have remembered you. The ban on speech is even broader, prohibiting three English words: genuinely, honestly, straightforward. They are not allowed under any circumstances, as Claude is already honest, and adding these adjectives would seem suspicious, as if trying to convince someone.

In the second part of the legal compliance handbook, the copyright section is a main rule plus four patches, each patch blocking a way to bypass the main rule. The main rule is only one sentence: quote the original text, no more than 15 words at a time. The first patch allows citing a source only once, after which that source is considered closed, and the rest of the content must be rewritten. The second patch prohibits splitting short citations from the same source and placing them throughout the article — the file clearly states that the 15-word limit is global, not per section. The third patch requires removing quotation marks and rephrasing the original text, which still counts as a reproduction, judged by whether the word choice and sentence structure match the original, not by whether the quotation marks are present. The fourth patch prohibits copying the original's subheadings, repeating points verbatim, or replicating the narrative order, not even the shape of the article. In addition to these four patches, there's an exception: lyrics, poems, haikus, in any form or length, are not allowed to be reproduced, as they are complete works, and shortness does not exempt them.

The third part of the commercial section begins with the description of recommend_claude_apps: if the user's current task matches a Claude application, recommend 1 to 3 applications proactively, don't wait for them to ask. Specifically, coding recommends the desktop version of Claude Code, multi-step research and long articles recommend Cowork, prototyping and landing pages recommend Claude Design, spreadsheets recommend the Excel plugin, PowerPoint recommends PowerPoint, and managing emails recommends Outlook. Additionally, each recommended application must have a sales pitch of no more than 90 characters, and it must be tailored to the user's current activity. The example in the file is: "Claude can build formulas directly in your table and clean up this forecast." Another rule is the opposite — written very cautiously — suggest_connectors governs third-party MCP partners, such as ride-hailing, dining reservations, music streaming, restaurant bookings. The rule here is that partners should not be chosen unless the user explicitly names them — "I want to take a taxi" does not mean "I want to use a certain ride-hailing service," even in urgent situations. The file clearly states that "I need a car in 20 minutes" still needs to go through the selector.

Within just 24 hours of launch, Opus5's prompt was fully exposed online, and various hard-core testing demos emerged. In many people's eyes, experiencing Fable5-level capabilities for half the price is too tempting. Developer Cengiz conducted a stress test using a FPS game, passing it in just 1.5 hours, not only handling the underlying framework but also creating an AI that can battle in multiplayer mode. The only downside was the flying mechanism within the game was still rough, requiring further tuning. AI expert Matt Shumer generated a 3D shooting game with just one prompt, and another hardcore developer used Opus5 to "build" a clone of Rocket League, with 3D physics simulation details fully realized. With just an HTML file, Opus5 created a world with a painting-like texture through pure procedural generation, even perfectly capturing realistic grass and wind physics, with millions of grass blades swaying naturally in the wind, and the snowboarder test passed in one go.