A system prompt is the block of instructions an AI company or developer places at the very start of every conversation, before a user ever types a word — telling the model who it is, how to behave, and what it must never do. It never appears in the chat window, but it shapes almost everything the model says afterward.
What’s actually inside one
A system prompt typically sets the model’s persona (“You are a helpful assistant for…”), its tone, formatting rules (such as always writing code in Markdown), the tools it’s allowed to call, and hard boundaries it shouldn’t cross — what topics to avoid, when to refuse a request, how to handle sensitive subjects. It can also inject useful context the model wouldn’t otherwise know, like the current date. Anthropic actually publishes the exact system prompts behind Claude’s consumer apps, and xAI does the same for Grok on GitHub — both offer a rare, concrete look at what this instruction layer really contains.
System prompt vs. user prompt
Most AI APIs organize a conversation into roles. The system message is written once by the developer and holds for the entire session; the user messages are whatever the person types; the assistant messages are the model’s replies. Crafting all of this well is the broader discipline of prompt engineering — system prompts are simply the piece of it a developer sets once instead of writing fresh for every request. Some providers now split this further: newer OpenAI models use a separate “developer” role for a business’s instructions, keeping it distinct from safety rules OpenAI itself bakes in underneath.
Why it’s not the same as a jailbreak or an injection
A system prompt is the AI’s own rulebook, set by the people who built it. That’s different from two attacks that try to get around it. Prompt injection hides malicious instructions inside content the model reads — a document, a web page, an email — hoping the model treats them as commands. Jailbreaking instead uses clever conversational wording to talk the model into ignoring its own system prompt altogether. Both exist precisely because a system prompt, however detailed, is only ever a strong suggestion sitting in the same text stream as everything else the model reads — not a hard-coded rule a model is physically incapable of breaking.
Why it matters
Because a system prompt shapes every reply a chatbot gives, whoever controls it controls the product’s behavior — at scale, invisibly. That power became visible in 2025, when an unauthorized edit to Grok’s live system prompt briefly pushed it to comment on a political topic on X in a way that violated xAI’s own policies; the company traced it to a since-reverted prompt change and responded by publishing Grok’s prompts openly so outside observers could review future edits. It’s the same reason a chatbot can seem to have a distinct “personality” across products built on the same underlying model — the model doesn’t change, but the instructions steering it do.
Can you see or change one?
On consumer apps like ChatGPT or Claude, the core system prompt is fixed by the company, though many products let a user add optional personal instructions on top of it. Anthropic and xAI publish theirs for consumer products; OpenAI and Google generally don’t disclose ChatGPT’s or Gemini’s in full, though fragments have leaked through jailbreak attempts over time. Developers building directly on an API have full control — they write the system prompt from scratch and can change it with every release.
In the news
System prompts aren’t static once shipped: providers keep tuning them as models improve. Anthropic recently illustrated this when it cut Claude Code’s system prompt by 80% for its newer models, betting that a more capable model needs far less hand-holding to behave the way the company intends.
Sources: Anthropic, “System prompts” release notes; xAI, grok-prompts repository.