A single GitHub repository documenting extracted system prompts from more than 28 AI coding tools has accumulated 134,000 stars and 33,700 forks — numbers that rival major open-source frameworks — signaling that prompt extraction has moved from a hobbyist curiosity to a structured, community-maintained accountability practice that AI vendors can no longer ignore.
What the Repositories Actually Contain
Two repositories are at the center of this story. The first, system_prompts_leaks, is a publicly accessible GitHub project explicitly framed as a catalog of internal instructions pulled from major AI assistants including Claude, ChatGPT, and Gemini. The second, a broader compilation focused on AI coding tools, covers products including Cursor, Windsurf, Claude Code, Augment Code, and Devin AI. As of March 28, 2026, that second repo had logged 489 commits across 28 contributors — the hallmarks of an organized, ongoing effort, not a one-time dump.
These are not hacks in the traditional sense. System prompts are extracted through a well-documented technique: users or automated scripts ask models to repeat or summarize their own instructions. Some models comply partially; others have been observed leaking structured policy language verbatim. The prompts circulating publicly include behavioral guardrails, persona definitions, tool-use instructions, and — critically for enterprise vendors — language that may reflect contractual clauses embedded by corporate customers or platform operators.
Verified Facts vs. What Remains Unconfirmed
Verified:
- The coding-tool prompt repo reached 134,000 GitHub stars and 33,700 forks, per coverage citing the repository directly.
- The repo covers more than 28 distinct AI tools with 489 commits and 28 contributors as of late March 2026.
system_prompts_leaksis a live, public repository documenting prompts attributed to Claude, ChatGPT, Gemini, and others.- Products named in circulating prompt compilations include Cursor, Windsurf, Claude Code, Augment Code, and Devin AI.
Unconfirmed and treated with caution:
- Some secondary sources in the same coverage wave reference prompts attributed to models named “ChatGPT 5.5” and “Claude Fable 5.” Neither Anthropic nor OpenAI has confirmed these model names as of publication. LLM Watch is not treating those claims as verified until primary vendor documentation or direct repository evidence surfaces.
Why This Is an Accountability Story, Not Just a Security Story
The framing of prompt leaks as a pure security problem — something vendors need to patch — misses the more consequential dynamic. When a system prompt is extracted and published, it becomes auditable. Researchers, regulators, and competitors can inspect whether a vendor’s stated policies match its embedded instructions. That gap, when it exists, is where AI vendor accountability becomes concrete rather than theoretical.
For enterprise deployments, the stakes are higher still. Operators who embed proprietary workflow logic, compliance language, or contractual clauses directly into system prompts — a common practice for legal, financial, and healthcare AI tools — are now operating with the understanding that those instructions may not stay private. No major vendor has published a clear technical standard for how operator-level prompt confidentiality is enforced at inference time.
The broader policy debate is also shifting. Discussions about operational transparency in AI — who can inspect model instructions, who can audit them, and what counts as legitimate disclosure — have accelerated alongside the prompt-leak phenomenon. The EU AI Act’s transparency requirements for high-risk systems and ongoing U.S. executive discussions about AI oversight both touch on whether system-level instructions should be subject to disclosure regimes. Prompt extraction, in this context, is civil society doing informally what regulation has not yet mandated formally.
What Builders Shipping AI Products Should Do Now
If you are building on top of a foundation model and embedding business logic in system prompts, the 134,000-star repository is a practical signal, not an abstract threat:
- Assume extractability. Any instruction you place in a system prompt should be written as if it could be read publicly. Do not embed credentials, proprietary pricing logic, or sensitive contractual clauses in plain-text prompts without a separate confidentiality layer.
- Audit your own prompts first. Run the same extraction techniques against your own deployments that the community is running against major vendors. Know what leaks before your users do.
- Separate policy from instruction. Where possible, enforce behavioral constraints at the application layer — not solely inside the prompt — so that a leaked prompt does not fully expose your operational logic.
- Watch the vendor response gap. None of the major vendors named in these repositories — Anthropic, OpenAI, Google, Cursor, Cognition (Devin) — has issued a public technical statement specifically addressing prompt confidentiality enforcement. That silence is itself a data point.
The Honest Counter-Argument
Not everyone agrees that prompt transparency is net-positive. A reasonable counter-position holds that publishing extracted system prompts — especially for safety-critical or enterprise tools — creates a roadmap for adversarial prompt injection and jailbreaking. If bad actors know exactly what guardrails a model has been given, circumventing those guardrails becomes a more tractable engineering problem. The accountability argument and the security argument are in genuine tension here, and neither side has a clean answer.
What is not in dispute: the normalization of prompt extraction as a community practice is outpacing vendor policy. The gap between what AI companies say about their systems and what can be independently verified just got measurably smaller — 134,000 stars at a time.