A prompt is everything a language model receives before it produces a single word of output. At its simplest it is a sentence typed into a chat box. Inside a production system it is a much larger assembly: developer instructions, the conversation so far, retrieved documents, tool definitions, formatting rules and the user's actual request, concatenated into one sequence and passed to the model in a single call. Models hold no memory between calls. Whatever a system appears to know about a task, a product catalogue or a customer was placed in the prompt by someone.

The unit matters because it displaced an older method of control. Adapting a model to a new task used to mean fine-tuning, retraining weights on labelled examples, a process demanding data, compute and machine learning staff. Prompting moved that control into plain text. The same frozen model performs different jobs depending on what precedes the request, which is why a marketing team can redirect a system by rewriting a paragraph.

How a prompt is assembled

Commercial APIs no longer accept a single block of text. They accept a structured list of messages, each carrying a role. The system role holds standing instructions: what the model is acting as, what it must refuse, which tools exist, how output should be shaped. The user role carries the request, the assistant role the model's earlier replies, replayed on every turn so the exchange appears continuous, and a tool role the output of a function the model called. OpenAI's Chat Completions API, introduced in March 2023, replaced the older single prompt string with this message list, and the structure spread. Anthropic's Messages API keeps the system prompt out of the message array entirely.

Role encodes priority. OpenAI researchers led by Eric Wallace published "The Instruction Hierarchy" on April 19, 2024, opening with the observation that models "often consider system prompts (e.g., text from an application developer) to be the same priority as text from untrusted users and third parties". The paper describes training models to rank instructions by source, so a developer's rule outranks a user's request, which outranks text arriving from a web page.

System prompts in deployed products run long. Documentation for Claude 4 published on X on May 22, 2025 described a structured decision tree sorting questions into four search behaviours, from never_search for stable facts to research for queries needing 2 to 20 tool calls, and prioritising "semantic prompt fit" over conventional authority signals.

Every element of the assembly is converted to tokens and billed as input, so length is a direct cost. Providers responded with prompt caching, added by Anthropic in August 2024 and by OpenAI two months later, which stores a processed prefix and charges a fraction of the base rate to reuse it.

Origin and evolution

The technique arrived with scale. Tom Brown and 30 co-authors at OpenAI posted "Language Models are Few-Shot Learners" to arXiv on May 28, 2020, describing a 175 billion parameter model that performed new tasks from a description and a handful of examples supplied in the input rather than from gradient updates. Pengfei Liu and five co-authors catalogued the emerging field in "Pre-train, Prompt, and Predict", posted on July 28, 2021, which framed prompting as a paradigm distinct from supervised learning.

Method followed. Jason Wei and colleagues at Google posted "Chain-of-Thought Prompting Elicits Reasoning in Large Language Models" on January 28, 2022, showing that eight worked examples containing intermediate reasoning steps lifted a 540 billion parameter model to state of the art accuracy on the GSM8K maths benchmark. Phrasing alone, with no change to the model, unlocked capabilities the same model otherwise failed to show.

Vulnerability followed just as quickly. Riley Goodside demonstrated on September 11, 2022 that instructions embedded in user-supplied text could override a developer's own, and Simon Willison named the class of attack the following day. Nothing in the architecture separates instruction from data, because both are simply text.

ChatGPT's launch on November 30, 2022 turned the prompt from a developer artefact into a mass behaviour. By July 2025, according to figures OpenAI gave and TechCrunch reported, users were sending 2.5 billion prompts a day. Training followed demand, and Anthropic published a free nine-chapter prompt engineering course in May 2025.

The vocabulary then shifted again. Anthropic argued on September 29, 2025 that prompt engineering had become a subset of context engineering, defined in the company's engineering blog as "the set of strategies for curating and maintaining the optimal set of tokens (information) during LLM inference". A prompt is written once; context is curated on every turn of an agent loop.

Prompts as a media surface

The commercial consequence is that a prompt is now an inventory unit. ChatGPT advertising launched on February 9, 2026, and measurement vendors began indexing prompts the way they had indexed keywords. Adthena launched a platform on May 11, 2026 monitoring more than 300,000 daily prompts for competitor bids, ad copy and share of voice. Its later index counted 7,378 distinct advertisers across three markets in the week of July 13, 2026, scoring visibility as the prompts where an advertiser appeared divided by prompts monitored. Analysis of roughly 850,000 AI search queries found retail and fashion taking 39% of observed ad items on 24% of US query volume, with ads on 4.47% of US queries between March and May 2026 and 1.06 sponsored items per ad-bearing answer against 3.53 on Google's AI surfaces.

Creative has started keying off the prompt itself. Criteo, which reached 2,000 brands on ChatGPT ads by June 2026, sells a format that adapts product selection and description to the semantic content of an individual query, reporting roughly four times higher spend delivery after activation. Campaign management is moving the same way. Google Ads gained dashboards generated from typed questions in August 2026, and OpenAI's head of monetisation, Asad Awan, sketched a buying interface built on the same gesture in February 2026, saying advertisers should be able to state "my goal is sell these shoes more in Midwest and go".

What complicates the surface is that the prompt a user writes is rarely the prompt that retrieves anything. Analysis of 5 million query expansions collected between April 1 and 21, 2026 by Tomek Rudzki found ChatGPT rewriting queries before executing them, issuing 2.1 sub-queries per prompt against 1.4 for Perplexity and 6.8 for Grok, and injecting evaluative vocabulary users never typed, led by "best" at 15.33% of added terms. Traffic analysis of 60 conversations captured in July 2026 found brands named in the model's own generated queries reaching the final answer 68.9% of the time against 2.1% for brands merely retrieved, with brand names appearing in 21 of 27 tested queries before any server was contacted.

Limitations and disputes

Output quality varies enormously with wording, which undermines any benchmark of models taken apart from the prompts used. A study of 2,112 business documents run with content marketing firm Wortliga found scores for the same model swinging between 1 and 96 points on a 100-point scale depending entirely on how the instruction was written, a spread far wider than the 10-point gap separating ChatGPT at 37.7 from Claude at 47.7.

Repetition does not produce repetition. Measurement across three AI platforms and six countries over 17 consecutive weeks found ChatGPT rotating 74% of its citations weekly and Google's AI Mode 56%, with no decline across the window. An identical prompt submitted twice can return different sources, which makes any single prompt-level observation weak evidence.

Security remains the sharpest objection. Because instructions and data share one channel, text on a web page can hijack an agent reading it. Brave's security team documented indirect prompt injection against Perplexity's Comet browser from August 2025, using white text on white backgrounds and colour contrasts invisible to humans; Perplexity's security team responded that "malicious prompt injection remains an unsolved problem across the industry". Anthropic's testing before the Claude for Chrome research preview measured a 23.6% attack success rate across 123 test cases covering 29 scenarios, falling to 11.2% with mitigations applied, a reduction rather than a fix.

Whether prompt writing is a durable skill is contested. Anthropic's fifth Economic Index report, covering one million conversations from February 2026, found users with six months of experience succeeding 73.1% of the time against 66.7% for newer users, a gap narrowing to three or four percentage points once task type was controlled for, with cohort effects and survivorship bias unresolved. Others argue that better models absorb what prompt engineering used to supply, and that the work has migrated to retrieval, tooling and evaluation.

Disambiguation

A query is what a search engine matches against an index. A prompt is not matched; it conditions generation. The two diverge because assistants rewrite prompts into multiple internal queries before retrieval.

A system prompt is one component of a prompt, holding developer instructions that persist across turns and outrank user text under the instruction hierarchy. Consumers rarely see it.

The context window is the token ceiling a prompt must fit inside, not the prompt itself.

Prompt engineering is the practice of designing prompts, increasingly folded into context engineering, which governs everything placed in the window during a multi-step agent run.

Recent developments

Prompt-level data has become the substitute for keyword data as search volume moves into assistants. Microsoft published a guide for marketers on how AI systems choose which brands to recommend in February 2026, describing a three-stage process of training knowledge, retrieved grounding and structured first-party signals. Only 16% of brands track AI visibility as the IAB works toward a measurement standard. Whether a unit the platform rewrites before use, that returns different sources on repetition and remains open to injection, can carry the reporting weight the keyword once did is unresolved.

Timeline

  • May 28, 2020: OpenAI posts "Language Models are Few-Shot Learners", describing task performance from examples supplied in the input
  • July 28, 2021: Pengfei Liu and co-authors publish "Pre-train, Prompt, and Predict", framing prompting as a distinct paradigm
  • January 28, 2022: Jason Wei and colleagues publish chain-of-thought prompting, reaching state of the art on GSM8K with eight exemplars
  • September 11, 2022: Riley Goodside demonstrates instruction override through user-supplied text
  • September 12, 2022: Simon Willison names the attack class prompt injection
  • November 30, 2022: ChatGPT launches, making prompt writing a consumer behaviour
  • March 2023: OpenAI's Chat Completions API replaces the single prompt string with a list of role-tagged messages
  • April 19, 2024: OpenAI publishes "The Instruction Hierarchy", proposing trained priority between system, user and third-party text
  • August 2024: Anthropic introduces prompt caching, reducing the cost of repeated prompt prefixes
  • May 22, 2025: Claude 4 system prompt documentation circulates publicly
  • August 2025: Brave documents indirect prompt injection against the Comet browser
  • September 29, 2025: Anthropic publishes guidance positioning context engineering as the successor discipline to prompt engineering
  • February 9, 2026: ChatGPT advertising launches, making prompts an addressable ad surface
  • May 11, 2026: Adthena launches prompt-level competitive intelligence for ChatGPT ads
  • August 2026: Google Ads adds dashboards generated from typed prompts

Summary

Who. Model providers define prompt formats and the privilege ordering between system, user and tool messages. Developers write system prompts; consumers write the visible request. Advertisers, agencies, measurement vendors and security researchers all now work at the prompt layer.

What. A prompt is the complete input sent to a language model in one call: instructions, conversation history, retrieved material, tool definitions and the request itself, tokenised into a single sequence. It replaced fine-tuning as the primary means of directing model behaviour.

When. The technique was formalised by the GPT-3 paper in May 2020 and surveyed as a paradigm in July 2021. Chain-of-thought arrived in January 2022, prompt injection in September 2022, mass consumer use with ChatGPT in November 2022, and prompt-level ad measurement in 2026.

Where. Prompts are assembled inside APIs and agent frameworks, entered through chat interfaces and browser agents, and increasingly through advertising platforms that accept typed instructions in place of configured settings.

Why. The prompt is where control, cost and risk converge. It determines output quality more than model choice does, it is metered as input tokens, it is the surface being sold to advertisers in conversational products, and it carries an unsolved security flaw because instructions and untrusted data travel through the same channel.