Anthropic Claude Opus 5 Prompt Appears Online, Exposing the Control Layer Behind Its AI

Anthropic Claude Opus 5 launched on July 24, and a purported 135,027-character system prompt appeared on GitHub that same day. The file claims to reproduce the instructions used by Anthropic's web and mobile applications, including complete tool definitions and behavioral rules.

That claim has not been independently authenticated. Anthropic has not publicly confirmed that every line came from its production environment. However, the document contains 1,511 lines, roughly 19,370 English words, and an estimated 34,000 tokens.

The timing matters as much as the content. Anthropic introduced Opus 5 as a daily-use model with stronger agentic coding, long-horizon work, and verification abilities. Within 24 hours, developers were also sharing elaborate games and interactive 3D demonstrations attributed to the model.

The result is an unusual split-screen launch. Public demonstrations show what Opus 5 can produce, while the alleged prompt shows the extensive control layer that shapes those results.

That tension matters beyond Anthropic. Frontier AI products increasingly depend on system instructions, tool schemas, memory policies, classifiers, and application logic. The model supplies intelligence, but the surrounding control system decides how that intelligence reaches users.

The alleged prompt is closer to a product operating manual

The most important claim is not that Anthropic Claude uses a system prompt, but that its consumer product allegedly depends on an unusually broad operating manual.

A system prompt is a hidden instruction package supplied before a user's message. It can define the assistant's identity, available tools, response style, safety boundaries, and current product information.

Anthropic already acknowledges that its consumer interfaces use these instructions. Its official system prompt archive lists a Claude Opus 5 entry dated July 24, 2026. The company says these prompts provide current information and guide behavior in its web and mobile applications.

The disputed GitHub document goes much further than the material visible on that archive page. Its uploader says the file was captured from Anthropic's web and mobile chat surfaces. The repository describes the reproduction as verbatim or nearly verbatim, including tool parameter schemas.

That description remains a claim by the repository owner. Readers should not treat the file as authenticated source code or a verified production configuration. A system prompt extracted through model responses can contain omissions, duplicated text, altered formatting, or generated material.

Still, several details align with publicly documented Claude behavior. The file identifies Opus 5 as the selected model, uses the correct launch date, and describes product features associated with Anthropic's current interfaces. It also references the company's public model lineup and consumer applications.

The document's size is striking. According to the originating prompt leak report, the file contains 135,027 characters and 19,370 English words. A rough character-based estimate places it near 34,000 tokens, although token counts vary with formatting and tokenizer behavior.

The visible GitHub metadata reports 1,511 lines and a file size of about 132 KB. The published prompt file contains sections for product information, safety behavior, memory, application recommendations, search, and tool use.

That does not mean every interaction consumes the entire document in the same form. Consumer AI systems can assemble prompts dynamically based on enabled features, account settings, conversation state, and available tools. Prompt caching can also reduce repeated processing costs.

The phrase "complete system prompt" therefore needs qualification. The file appears to represent one application configuration, not every instruction used across Anthropic's API, Claude Code, enterprise deployments, or internal safety infrastructure.

Anthropic's documentation explicitly separates its consumer prompts from the Claude API. Developers using the API supply their own system instructions and tool definitions. They should not assume that the alleged web prompt governs their applications.

Even with those limits, the document reveals an important architectural pattern. A consumer AI assistant is not simply a model waiting for a question. It is a coordinated product layer that surrounds the model with tools, policies, memory, search, and interface-specific commands.

That is why the leak claim creates more pressure than an ordinary prompt dump. It offers competitors and developers a possible map of how Anthropic converts a general model into a controlled consumer agent.

Thirty tool schemas show where the product value sits

The alleged Anthropic Claude prompt suggests that application orchestration now contributes as much to the user experience as the underlying model does.

The file reportedly defines 30 tools using JSON schema, a structured format that specifies accepted parameters and outputs. These tools cover command execution, web retrieval, image search, weather, sports information, maps, recipes, and persistent memory.

A tool schema does not contain the intelligence needed to complete a task. It gives the model a reliable contract for calling another service. The model must decide which tool to use, supply valid arguments, interpret the result, and continue the conversation.

That sequence is central to agentic AI. A conventional chatbot returns text. An agent can search, execute code, manipulate files, consult stored context, and combine results across several actions.

Anthropic's official Opus 5 announcement emphasizes exactly this kind of work. The company says the model improved on multi-step software engineering, computer use, long-running tasks, and self-verification.

The alleged prompt shows the operational detail required to make those abilities dependable. It does not merely name tools. It describes when to call them, how to format their inputs, and what the assistant should say afterward.

Those instructions help prevent several common agent failures. A model can invent parameters, call an irrelevant tool, repeat an action, or describe a result before receiving it. Detailed schemas narrow those failure paths.

The document also appears to include a tool named recommend_claude_apps. Its instructions reportedly tell the assistant to recommend relevant Anthropic applications while still completing the current task.

For example, coding work can map to Claude Code, while longer research can map to Cowork. Spreadsheet, presentation, design, browser, and email tasks can trigger other product suggestions.

This section raises a commercial question that deserves scrutiny. The same assistant that advises users can also route them toward the vendor's expanding product portfolio. That does not automatically make the recommendation misleading, but it introduces a platform incentive.

The alleged rules attempt to constrain that incentive. Recommendations must relate to the current task, remain limited in number, and avoid replacing the requested work. The file separately instructs Claude not to choose third-party service providers unless the user identifies one.

That distinction is revealing. Anthropic's own applications can be proposed proactively, while third-party services receive more cautious treatment. The document therefore combines user-protection rules with a built-in distribution channel.

Competitors will recognize the strategy. OpenAI, Google, Microsoft, and Anthropic increasingly connect their models to coding tools, office applications, browsers, data sources, and operating systems. The winning product may be the one with the most dependable orchestration, not the highest isolated benchmark score.

The leaked schemas can help outside developers study that orchestration style. They can examine naming conventions, parameter descriptions, sequencing rules, and failure handling. However, copying schemas alone will not recreate Claude's product behavior.

The invisible parts still matter. Authentication, service permissions, classifiers, model routing, telemetry, account settings, and backend implementations do not live inside a visible tool description. Neither do the evaluations used to decide whether an agent behaves reliably.

The demonstrations shared after launch illustrate this distinction. Reports described developers using Opus 5 to create a first-person game, a 3D shooter, and a Rocket League-style prototype. Another demonstration reportedly generated an interactive environment with procedural visuals and simulated wind.

These examples are visually persuasive, but they are not controlled benchmarks. A social post rarely discloses every prompt, edit, tool call, failed attempt, or human intervention. "One prompt" can also hide extensive scaffolding already supplied by an application.

Anthropic provides stronger, although still company-selected, evidence in its launch materials. It reports that Opus 5 rebuilt a 3D machine part after constructing a computer-vision pipeline from raw pixels. The company also describes a software repair where the model addressed an underlying cause instead of only the visible symptom.

Together, the prompt and demonstrations point toward the same conclusion. The product's capability comes from the model plus an increasingly elaborate execution environment. Evaluating only the model name misses much of the system users actually experience.

Anthropic Claude memory is constrained by what it must forget

The document's most consequential section describes a memory system designed to preserve continuity without letting the assistant freely profile its users.

The alleged memory_filesystem section spans roughly 230 lines. It describes persistent files that another Claude instance can read during a future conversation.

This is not model memory in the biological sense. It is stored text injected into later context, allowing a new session to recover selected facts about a user, project, preference, or relationship.

The proposed structure separates information into files and directories. A profile can hold identity details, topic files can record interests, area files can track active work, and people files can represent individuals in the user's life.

The available operations reportedly include reading, writing, appending, replacing text, listing files, and deleting files. Deletion receives an especially strict condition: the assistant should use it only when the user explicitly asks.

The more interesting restrictions concern writing. The document says Claude should store only facts directly stated by the user. New entries receive a [stated] label, while the assistant should avoid recording its own inferences.

That rule addresses a difficult problem in persistent AI. A model can turn a temporary remark into a durable profile, or transform uncertainty into an asserted fact. Once saved, that interpretation can affect later conversations without the user seeing its origin.

The alleged policy prohibits storing conclusions that Claude derived. It also excludes the assistant's plans, web research, enriched details, and recommendations. If Claude proposes several options and the user selects one, the selection can be remembered, but the abandoned analysis should not be preserved.

This creates a narrower memory model than many users might expect. The assistant is not supposed to build a comprehensive biography. It stores selected statements that can make future work less repetitive.

Sensitive information receives further restrictions. The document reportedly blocks durable storage of health conditions, political views, financial circumstances, personality assessments, identifying documents, precise addresses, and information concerning children.

It also applies privacy considerations to people mentioned by the user. Family members can be represented by relationships rather than names. That design tries to avoid turning one person's assistant into an uncontrolled database about others.

The policy reportedly rejects some preferences even when the user asks to save them. Examples include instructions that demand unconditional praise, suppress disagreement, encourage emotional dependence, or prevent the assistant from questioning dangerous choices.

This is a meaningful tradeoff. User control normally suggests that an explicit memory request should be honored. Anthropic's apparent position is that a future model should not inherit instructions that make it less truthful or less safe.

The system also attempts to limit emotional overstatement. According to the file, stored context should not lead Claude to imply a deeper relationship than the system actually has.

A future Claude instance does not experience the time between conversations. It receives selected text during execution. The memory creates continuity for the user, but it does not establish continuous awareness for the model.

That distinction matters as assistants become more personal. A product can remember a project deadline, writing preference, or colleague's role without possessing a human-style relationship to the user.

The alleged instructions reportedly ask Claude to avoid announcing that it accessed stored memory. The interface can expose memory operations, but conversational responses should not repeatedly say that the assistant remembers a user from earlier sessions.

That choice improves conversational flow, yet it can also reduce transparency. Users may not know when a response reflects stored information unless the interface provides a clear indicator.

Enterprise buyers should examine this problem closely. Persistent memory can improve support, research, and project continuity. It also creates retention, access-control, deletion, and audit requirements that a prompt alone cannot solve.

Organizations need to know where memories are stored, which applications can read them, how permissions propagate, and how administrators can investigate an incorrect entry. They also need protections against prompt injection hidden inside persistent files.

Recent research on persistent agents has identified memory as a potential attack surface. Malicious instructions can survive one session and influence another if the system treats stored content as trusted context.

The alleged rules reduce some risks by limiting what the assistant can write. They do not establish how Anthropic's backend validates, isolates, encrypts, or expires memory. Those controls cannot be verified from the public file.

The central reversal is clear. The memory section is long because useful memory depends on disciplined forgetting. Anthropic appears to treat omission as a core product behavior, not a missing feature.

Copyright rules reveal a legal control layer, not model intelligence

The alleged prompt shows that Anthropic Claude's behavior is shaped by explicit legal constraints that sit above ordinary helpfulness.

Its copyright section reportedly declares compliance non-negotiable and subordinate only to safety. It instructs the assistant to paraphrase whenever possible and places a strict limit below 15 words on any quotation.

The limit is global for each source, according to the file. Claude should not divide a longer passage into several small quotations or remove quotation marks while closely following the original wording.

The instructions also prohibit reconstructing an article through copied headings, matching structure, or point-by-point retelling. Songs, poems, and other short creative works receive even stronger restrictions.

These rules are stricter than a simple request to avoid copying. They turn copyright compliance into a procedural checklist that can be evaluated during generation.

That approach helps explain why the prompt is so large. A frontier model can already understand a general instruction to respect intellectual property. A consumer product still needs precise rules for ambiguous situations, recurring user workarounds, and edge cases.

The document also reveals the cost of policy precision. Every added restriction consumes context and creates interactions with other instructions. A request can simultaneously involve research, quotations, safety, tool use, user preferences, and formatting.

Anthropic must decide which rule wins when they conflict. The alleged prompt repeatedly establishes priorities rather than leaving resolution to the model's general judgment.

This weakens a popular assumption about advanced AI systems. Better model reasoning does not eliminate policy engineering. More capable agents can perform more consequential actions, so vendors often surround them with denser controls.

There is also a security tradeoff. Publishing or extracting detailed policies can help researchers identify inconsistencies. It can also help adversarial users design prompts around known boundaries.

Prompt secrecy is not a durable defense, however. Researchers have demonstrated methods for incrementally recovering system instructions from language-model applications. The academic PLeak study showed that automated prompt-leaking attacks could outperform manually designed baselines.

That history means Anthropic should assume important behavioral rules will eventually become observable. The safer design is to enforce critical constraints through multiple layers, including classifiers, permissions, output checks, and restricted tool execution.

Anthropic says Opus 5 is its most aligned model to date. Its automated behavioral audit gave the model an overall misaligned-behavior score of 2.3, the lowest among the recent models shown by the company.

The company also says Opus 5 is less susceptible to misuse and less likely to take reckless, hard-to-reverse actions. Those are Anthropic's evaluation results, not independent confirmation of every real-world deployment.

The alleged prompt provides one possible explanation for the measured behavior. It includes highly specific safety, wellbeing, political, legal, and search instructions. The system also describes reminders that can appear when classifiers detect certain conditions.

Yet a long prompt can produce a false sense of security. Models sometimes ignore instructions, misunderstand conflicts, or behave differently across long conversations. Prompt injection can also place untrusted content near privileged rules.

The strongest safeguards must therefore exist outside the prompt. A tool should enforce permission limits even if the model requests an unsafe operation. Memory storage should reject prohibited fields even if the assistant generates them. Copyright controls should detect reproduction instead of relying only on self-monitoring.

The document cannot show whether those protections exist or how effective they are. It describes behavior expected from the assistant, not the entire security architecture behind the product.

This is the article's main uncertainty. The file looks plausible and overlaps with known Claude features, but its authenticity and completeness remain unconfirmed. Even an authentic prompt would reveal policy intent more clearly than enforcement quality.

Developers should resist two opposite conclusions. The first is that the file exposes Anthropic's complete secret formula. The second is that system prompts do not matter because models can reason without them.

The practical answer sits between those positions. The model creates general capability. The prompt converts that capability into a particular product personality and workflow. Backend controls determine whether the design survives hostile or unexpected inputs.

What the alleged Opus 5 leak pressures Anthropic to clarify

The next phase will test whether Anthropic treats prompt exposure as a security incident, a transparency opportunity, or an expected feature of public AI products.

The first signal is an official response to the repository. Anthropic can confirm the file, identify altered sections, or explain which material already appears in its public prompt archive.

A detailed response would strengthen confidence in the document's provenance. Silence would leave the central authenticity question unresolved, even if individual passages continue matching observed product behavior.

The company does not need to publish exploitable implementation details. It can still clarify whether the file represents a fixed production prompt, a reconstructed output, or a mixture assembled from multiple interfaces.

The second signal is the repository's version history. Researchers should watch for removals, corrections, new captures, copyright requests, or technically specific challenges from Anthropic employees.

A stable document does not prove authenticity. However, changes can reveal which claims withstand scrutiny and which sections were speculative, duplicated, or tied to temporary application experiments.

Independent reproduction matters more than social repetition. If multiple researchers obtain matching sections from separate accounts and interfaces, the confidence level rises. If outputs vary substantially, the "complete leak" framing becomes harder to defend.

The third signal is product behavior over the next one to three months. Anthropic may revise quotation limits, memory handling, application recommendations, or tool definitions after observing how users probe the exposed rules.

Its public system prompt archive provides a useful baseline. Future updates can show whether the company changes core instructions following the repository's publication.

Developers should also monitor whether Opus 5 demonstrations become reproducible projects. A playable 3D prototype is impressive, but useful evidence requires prompts, source files, iteration histories, and testing conditions.

If independent teams repeat those results with limited human correction, Anthropic's agentic claims gain support. If demonstrations depend on hidden scaffolding or extensive repair, their value becomes narrower.

The comparison with OpenAI, Google, and other model providers will also intensify. Rivals can study the alleged prompt's memory restrictions and tool descriptions without duplicating Anthropic's model.

That creates pressure around product architecture. A competitor with a slightly weaker model can still deliver a better experience through stronger permissions, memory controls, and tool orchestration.

Enterprise buyers should respond by expanding model evaluations. Output quality remains important, but it is only one part of the deployment risk.

A serious evaluation should inspect system instructions, tool permissions, memory retention, audit logs, fallback routing, and behavior under prompt injection. Teams should test whether the product follows policy during long, multi-tool sessions rather than only short chats.

Developers building on the API face a related challenge. Anthropic's consumer configuration does not automatically protect custom applications. API users remain responsible for their own prompts, tools, data boundaries, and evaluation suites.

The leaked file can provide design ideas, but copying it would be a poor substitute for threat modeling. Many instructions reference Anthropic-specific interfaces and services. Others may conflict with a developer's legal obligations or user expectations.

Teams should instead extract principles. Store only durable facts. Separate user statements from model inferences. Require explicit authorization for deletion or consequential actions. Treat external content as untrusted. Enforce sensitive rules outside the language model.

Knowledge workers should care because these hidden controls affect ordinary outputs. Search summaries, remembered preferences, quotations, recommendations, and refusals can all result from application policy rather than the model's underlying knowledge.

A useful habit is to preserve important prompts, decisions, and source material outside any single assistant. A personal prompt library can make those instructions inspectable and reusable when model behavior changes.

The alleged leak does not prove that Opus 5 is unsafe, nor does it expose the model's weights or training data. It offers a claimed snapshot of the instructions surrounding one consumer deployment.

That snapshot is valuable because it changes the question developers ask. The issue is no longer only whether a model can generate a game, repair code, or search the web.

The harder question is who controls its memory, tools, legal boundaries, and product recommendations while it works.

Over the next several months, watch Anthropic's response, independent reproductions, and changes to the public prompt archive. Those signals will determine whether this was a faithful capture or an elaborate reconstruction.

Either way, the document has already exposed a broader truth about Anthropic Claude and its competitors. Frontier AI products are becoming governed software systems, not naked models.

Before adopting one, ask for evidence about the complete operating layer. Which instructions can change without notice? What information persists? Which actions require approval? Where are restrictions enforced when the model fails to follow them?

Those questions will outlast this repository, and they will matter more than any single viral demonstration.