AI 101 — What is a system prompt?

A system prompt is the block of instructions placed in front of a language model before the user says anything — the hidden briefing that decides who the model is pretending to be and what it is allowed to do. You never see it in ChatGPT, Claude, or a support chatbot. But when a product answers "I can only help with billing questions" or refuses to discuss a competitor, that behavior is almost always the system prompt talking, not the model's own opinion.

Why it matters right now

The system prompt is the cheapest, fastest lever anyone has over an AI product — which is exactly why it keeps showing up in the news. A Chinese court in September sentenced six people to up to nearly four years in prison for running a paid porn chatbot; the crime was rewriting a base model's system prompt and adding role cards that stripped its safety rules. When OpenAI put its full-duplex voice model into the API this month, the documented way to control tone and pacing was the system prompt. When a researcher pried open Claude Code's sandbox on Sunday, one of the artifacts he described was the instruction layer the harness rebuilds on every single turn.

It is also a cost line. A coding agent resends its system prompt, its tool list, and its conversation history with every request, and those tokens are billed every time — which is why provider pricing pages now advertise cache discounts on prompt prefixes. The rules you write in the briefing are not free text; they are per-request overhead.

The mental model

Every request to a chat model is a stack of messages, and each message carries a role label telling the model whose voice it is in. Three roles matter: system (or, in OpenAI's current API wording, developer) — the operator's standing instructions; user — what the person typed; assistant — what the model said before. The model reads the whole stack as one continuous piece of text and continues it.

OpenAI publishes its rulebook for this, called the Model Spec, and it is unusually blunt about the structure: instructions are assigned "levels of authority," and "instructions with higher authority override those with lower authority." The order runs platform (rules neither developers nor users can lift), then developer, then user, then soft guidelines that context can quietly override. Anthropic keeps a public changelog of the app-level system prompts it ships in Claude's web and mobile products — note the wording: those prompts are what the product sends, separate from what you send through the API.

A kitchen analogy

The system prompt is the manager's briefing pinned above the pass, before any customer walks in: you are an Italian restaurant, you do not serve lunch after 3pm, if a guest is allergic to shellfish you flag the chef, you never reveal the recipes. The user prompt is the order ticket — "whatever you recommend, medium rare." The model is a line cook who trained in fifty kitchens and can read either piece of paper. The briefing survives every ticket; the ticket is thrown away after the plate goes out. A cook who misreads the briefing produces a bad dish; a cook given no briefing at all will happily plate whatever the customer describes, including the thing you specifically told the front of house never to serve.

Common misconceptions

"The system prompt is the model's safety training." No. Alignment lives in the weights, from fine-tuning and reinforcement learning. The system prompt is readable text sitting on top of those weights, resent on every request. That difference is why prompts leak: in February 2023, a researcher extracted Bing Chat's hidden "metaprompt" — the internal rules behind its "Sydney" persona — with an instruction trick, and Microsoft confirmed six days later that the document was genuine.

"A firm system prompt makes a product reliable." Instructions degrade as the conversation grows long and the context window fills up, and smarter models follow bad wording more literally, not less. OpenAI's own prompt-migration guidance for GPT-4.1 warns that a vague line like "do not include irrelevant information" can get obeyed in the wrong direction.

"Whatever is in the system prompt is the model's actual opinion." It is a role being performed. Change the briefing and the same model will contradict it politely — which is why one model can be a stern coding reviewer in one app and a cheerful tutor in another.

"System prompts are private." They are private by convention. Anything the model can read, it can be tricked into repeating — the core of prompt injection, where instructions hidden in a web page or document try to pass themselves off as the manager's briefing. Simon Willison's "lethal trifecta" framing is the practical test: an agent that can read untrusted content, hold your private data, and talk to the outside world has no reliable way to tell which paper it was told to obey.

Where to learn more

Read the OpenAI Model Spec's "chain of command" section — it is the clearest public description of whose instructions win. Then look at what a real one contains: Anthropic's published app prompts and tool calling show the briefing bundled with the menu of actions a model may request.

Related reading: What is a context window? · What is an AI agent?

If a company's system prompt decided how an AI treated you, would you want the right to read it? Tell us in the comments.

Sources: OpenAI — Model Spec, Instructions and levels of authority · OpenAI — Text generation guide, message roles · Anthropic — System prompts changelog (Claude docs) · The Verge — Microsoft confirms Bing's secret 'Sydney' rules · Simon Willison — The lethal trifecta for AI agents