Claude Opus 5 System Prompt Leaked: 1,511 Lines, Around 34,000 Tokens, with the Core Consisting Almost Entirely of Restrictive Rules

Shortly after Anthropic released its flagship model, Claude Opus 5, a full system prompt tied to the product surfaced on GitHub. According to the source article, the leaked material covers the underlying prompts used by both the claude.ai web app and mobile experience. In raw size, it reportedly spans roughly 135,027 characters and 19,370 English words, which translates to an estimated 34,000 tokens.

What makes the leak notable is not just its length, but its nature. This is not a simple startup instruction block in the usual sense. It reads more like a hybrid document made up of three layers: a product operations manual, a legal and compliance rulebook, and a set of policy rules around product recommendations.

What the leaked file reportedly contains

The article says the document appears in the GitHub repository Eversmile12/leaked-llm-prompts, under the path Anthropic/opus-5.md. It is organized into 64 chapters. Rather than focusing on code, most of the document is devoted to behavioral constraints that shape how the model should respond.

One major section defines tools. Around 30 capability modules are described, including support for bash commands, web retrieval, image search, sports scores, weather, recipe cards, and map-related functionality. Each tool reportedly comes with a fairly complete JSON schema explaining what parameters are expected, when the tool should be called, and how the model should handle the response afterward.

The longest section focuses on cross-session memory

The article identifies the longest chapter as memory_filesystem, a section dedicated to how Claude may store and use memory across conversations. At around 230 lines, it lays out a structured directory system for persistent memory:

• /profile.md: identity-related information

• /topics/: interests and recurring habits

• /areas/: ongoing matters

• /people/: information about people mentioned by the user

• /preferences.md: how the user wants Claude to behave

This memory setup supports six core actions: read, write, append, partial replacement, list directories, and delete. Among them, deletion is treated with special caution. The rules reportedly say it can only happen when the user explicitly asks for it.

Only user-stated facts may be stored

One of the strictest constraints in the leak is that every memory entry must carry the tag [stated]. That tag indicates the content was directly said by the user. According to the article, this is the only kind of memory entry Claude is allowed to write.

From there, the prompt sets out an extensive list of things that must not be stored:

• Conclusions inferred by Claude rather than explicitly stated by the user

• Generalized interpretations of user statements turned into vague preferences

• Claude’s own plans, unresolved tasks, or unconfirmed assumptions

• Information that can simply be searched again later

• Details rewritten, polished, or expanded by the model

• Claude’s own suggestions, even if the user later acts on them; only the user’s final confirmed choice may be recorded

A long privacy blacklist limits what can persist

The leaked prompt reportedly includes an unusually detailed privacy blacklist. The standard it uses is simple but broad: if a user would feel uncomfortable seeing a piece of information appear in settings or be viewed by a colleague, it should not be stored.

The article says the disallowed categories include race, political views, health conditions, psychotherapy, financial situation, personality assessments such as MBTI, home addresses, ID numbers, and anything related to children.

Those restrictions do not apply only to the user. They also extend to other people the user mentions. For example, if a user says they missed a run because of a diabetes flare-up and asks for a lighter plan, the system may retain something general like an interest in fitness, but anything tied to the medical condition must be removed entirely. The article emphasizes that even vague placeholders for such sensitive data are not allowed.

Names of family members are also reportedly blocked from direct storage in memory files. Instead, they are normalized into relationship labels. A mother would be stored under something like /people/mom.md, while a partner would go under /people/partner.md.

Some preferences cannot be saved, even if the user asks

The leaked rules also say certain user preferences should never be inherited across sessions, even if they are explicitly requested. According to the article, these include instructions that would:

• Force Claude to offer praise unconditionally or suppress disagreement

• Tell Claude to stop questioning health-related or risky decisions

• Encourage emotional dependency or sustain a romantic-style persona over time

• Prevent the model from challenging claims or giving candid evaluations

The stated reasoning is that preserving such instructions would make future instances of Claude less honest or less safe.

It may remember you, but should not sound like it does

Another striking detail is how tightly the prompt manages the appearance of memory use. Even though the interface may show that memory is being used, Claude is reportedly told not to casually say things like I remember, based on your profile, or last time you mentioned in ordinary replies.

Only when a user directly asks about memory is the model allowed to use more restrained phrasing, such as we talked about this before.

The article also notes that three English words are explicitly discouraged throughout the prompt: genuinely, honestly, and straightforward. The rationale given is that Claude should already be honest by default, and adding those qualifiers can sound like an attempt to persuade.

Copyright and compliance rules go beyond standard summarization limits

The legal and policy sections reportedly span copyright, child safety, crisis response, and political neutrality. Among these, copyright rules stand out as especially strict. The article says they are treated as higher priority than user requests and even usefulness, with only safety rules ranking above them.

The core rule is simple: Claude must not quote more than 15 words of original text at one time. But the document does not stop there. It also includes multiple anti-workaround rules designed to prevent users from reconstructing a source by degrees.

• A single source may only be quoted once; after that, the model must paraphrase

• The same source cannot be broken into multiple short quotes spread across the answer

• Removing quotation marks does not help if the wording still closely reproduces the original

• Claude must not mirror a source’s subheadings, point-by-point structure, or narrative order

Lyrics, poems, and haiku are reportedly handled even more strictly. The article says these are treated as complete works, meaning they cannot be reproduced at all, regardless of length.

Product recommendations are built in, but not without limits

The leaked material also suggests that Claude is instructed to recommend Anthropic-related products in relevant situations. A tool called recommend_claude_apps is said to let the model proactively suggest one to three apps when the user’s task matches a related product, even if the user did not ask for recommendations first.

The examples cited in the article include recommendations such as:

• For coding: Claude Code desktop

• For multi-step research and long-form writing: Cowork

• For prototypes and landing pages: Claude Design

• For spreadsheets: an Excel plugin

• For slide decks: PowerPoint

• For inbox organization: Outlook

Each suggestion reportedly must include a task-specific selling point in no more than 90 characters.

By contrast, the prompt appears much more cautious when third-party MCP partners are involved. The article points to a module called suggest_connectors, which says Claude should not choose a partner on the user’s behalf unless the user has already specified one. Even when the user is in a hurry, the model is reportedly not allowed to default to a particular external service.

The leak landed just as Opus 5’s capabilities were being stress-tested

The timing amplified the attention. Within roughly a day of launch, developers were already sharing rapid demonstrations of Claude Opus 5’s performance. The article references several examples: developer Cengiz reportedly used an FPS game as a stress test and completed the core framework plus multiplayer AI in about 1.5 hours on a first pass. Matt Shumer, meanwhile, is said to have generated a 3D shooter from a single prompt. Other developers reportedly built a Rocket League-style clone and showcased scene generation from a single HTML file, complete with an oil-painting look and physics-based grass and wind effects.

Those demos highlighted the model’s upper bound. The leaked prompt, however, draws attention to something else entirely: how heavily Anthropic appears to be investing in the lower bound.

What the leak ultimately reveals

According to the article’s framing, the most revealing part of this roughly 34,000-token prompt is not the tool definitions themselves, but the density of prohibitions surrounding them. The rules are detailed, repetitive, and highly specific. They seem designed to keep Claude from remembering too much, quoting too much, or deciding too much on the user’s behalf.

In that sense, the document offers a rare look at how Anthropic may be trying to govern not only what Claude can do, but what it must consistently refuse to do. While developers rushed to test the model’s ceiling, this leak gave outsiders a much clearer view of how the company appears to be enforcing its floor.