A system prompt is the block of instructions a developer places in front of a language model before any user says anything. It sets the model's identity, limits, tools and output format, and the user rarely sees it. It exists because the same general-purpose model sits behind a customer service bot, a coding assistant and an ad-buying agent, and something has to tell each deployment which job it is doing. Before this layer existed, specialising a model meant retraining it; a system prompt does the same work in text the operator can rewrite at will.

Every chatbot that now carries advertising or acts on a campaign account is shaped by a system prompt the advertiser cannot read. What that text instructs, and how far it holds, are now commercial questions.

How a system prompt works

Language models hold no memory between calls, and the system prompt is the constant part at the top of each fresh request. Commercial APIs accept input as a list of messages, each tagged with a role. The system role, renamed developer in OpenAI's current API documentation, carries the operator's standing rules. The user role carries the person's request. Assistant and tool roles replay the model's earlier answers and the output of functions it called.

Providers implement the slot differently. Anthropic's Messages API takes the system prompt as a separate top-level parameter rather than as an entry in the message array. OpenAI's Responses API offers an instructions parameter which, according to its developer documentation, takes priority over the prompt sent in the input field and applies only to the current request. Google's Gemini API uses a field called system_instruction. In each case the instructions are tokenised, placed ahead of the conversation and billed as input on every turn, so a prompt of thousands of tokens is a recurring cost. Prompt caching, introduced by Anthropic in August 2024 and by OpenAI two months later, stores the processed prefix so that repeated system prompts are charged at a fraction of the normal input rate.

A deployed system prompt typically states an identity, injects facts training cannot supply, such as the current date, lists tools with usage rules, sets refusal boundaries and specifies format. Anthropic says on its documentation site that its consumer apps "use a system prompt to provide up-to-date information, such as the current date, to Claude at the start of every conversation", and that those prompts "do not apply to the Claude API", where developers write their own.

Deployed prompts are long and procedural. A Claude 4 prompt posted on X on May 22, 2025 set out a four-tier decision tree for when to search the web, from never_search for stable facts to a research mode of "2-20 tool calls depending on query complexity", along with a rule against "reproducing large 20+ word chunks of content from search results".

Instruction hierarchy

A system prompt is only useful if the model ranks it above what users type, which early chat models did not reliably do. OpenAI researchers led by Eric Wallace wrote in "The Instruction Hierarchy", published on April 19, 2024, that models "often consider system prompts (e.g., text from an application developer) to be the same priority as text from untrusted users and third parties".

OpenAI codified the ordering in its public Model Spec. The version dated October 29, 2026 describes a chain of command with five levels. Root rules come from the spec itself and "cannot be overridden by conversational context". System messages from OpenAI sit next and "cannot be overridden by developers or users". Developer messages follow, then user messages, then guideline-level defaults that can be "overridden implicitly when the context clearly calls for it". Assistant and tool messages, along with quoted or untrusted text, carry no authority by default. The spec notes that developers "may not be aware of the existence or contents of the system messages" OpenAI inserts, so a business writes instructions beneath a layer it cannot inspect.

Anthropic describes a similar split between itself, operators who write system prompts and users who talk to the product. In both cases the hierarchy is a trained tendency, not an enforced boundary. Nothing in the architecture separates an instruction from data; both are text in one sequence.

Origin and evolution

ChatGPT's launch on November 30, 2022 put a hidden preamble in front of millions of users, and OpenAI's Chat Completions API, opened in March 2023, formalised the system role as the first message in a list.

Leaks began almost immediately. In February 2023, Stanford student Kevin Liu used a prompt injection to make Microsoft's new Bing Chat reveal its instructions, including its internal codename, Sydney. The pattern has repeated ever since: a user asks the model to repeat what preceded the conversation, and it obliges. Custom instructions, launched in ChatGPT in July 2023, and custom GPTs, launched in November 2023, then let ordinary users write system prompts of their own, and their prompts were extracted in bulk.

Providers responded by publishing. Anthropic posted the system prompts for Claude 3 Haiku, Claude 3 Opus and Claude 3.5 Sonnet in its documentation on August 26, 2024, each dated July 12, 2024, with a promise to update the page as prompts changed. As of November 2026 the page lists every model from Claude Haiku 3 to Claude Haiku 5.5, the latest entry dated October 26, 2026.

Publication became a crisis response at xAI. On May 14, 2025, according to the company, "an unauthorized modification was made to the Grok response bot's prompt on X", causing it to insert claims about "white genocide" in South Africa into unrelated replies. xAI said on May 16, 2025 that it would publish Grok's system prompts on GitHub, add review checks for employee changes and run round-the-clock monitoring, according to Engadget. A February 2025 edit telling Grok to ignore sources accusing Elon Musk and Donald Trump of spreading misinformation had been blamed by co-founder Igor Babuschkin on an employee.

The OWASP Top 10 for LLM Applications 2025 added LLM07:2025 System Prompt Leakage as a new entry, stating that "the system prompt should not be considered a secret, nor should it be used as a security control".

Why it matters for marketers

Advertising has arrived in products governed by system prompts, and the separation between the ad and the answer is a promise about how those instructions are written. When OpenAI confirmed ChatGPT ad tests on January 16, 2026, Fidji Simo, its CEO of Applications, said "ads will not influence the answers ChatGPT gives you", with ads placed at the bottom of answers and kept away from health, mental health and political topics. Nobody outside OpenAI can inspect the instructions that enforce that boundary.

Advertisers are also being handed something close to a system prompt of their own. Google's AI Brief, announced on April 30, 2026, lets Search advertisers write plain-language messaging, matching and audience guidelines for AI Max, such as "never mention prices", absorbing the earlier text guidelines, which allow up to 25 term exclusions and 40 messaging restrictions per campaign. Supermetrics, which connected Claude to six ad platforms on November 3, 2026, stores targets and naming conventions in a "Context Layer" applied in every chat, in effect a persistent system prompt. IAB Australia's prompting guide of November 19, 2025 recommends "defining rules and guardrails by specifying words, topics, or claims to avoid".

For visibility work, leaked prompts are rare documentation of how assistants choose sources; the Claude 4 prompt said the model "does not link based on authority or brand strength alone".

Limitations and disputes

A system prompt is advisory. A model can be talked out of it or redirected by text in a web page, the territory of prompt injection. Brave's researchers documented hidden instructions hijacking Perplexity's Comet browser in August 2025, and Anthropic measured a 23.6% attack success rate against its Claude for Chrome preview, falling to 11.2% with mitigations.

Confidentiality is disputed. Some operators treat prompts as trade secrets; OWASP's position is that any credential or transaction limit in a prompt should be assumed public. Anthropic and xAI publish theirs.

Publication has limits too: Anthropic's text covers its apps, not the API or classifiers outside the prompt, and Grok's May 2025 incident showed a repository does not prove what runs in production.

Brand deployments carry liability. In February 2024 a Canadian tribunal held Air Canada responsible for a refund policy its website chatbot invented, rejecting the argument that the bot was a separate entity.

Disambiguation

A prompt is the full input sent to a model in one call. The system prompt is one component of it, the standing operator layer, as explained in PPC Land's explainer on prompts.

A user prompt is the person's request, which changes every turn and ranks below the system prompt.

Prompt injection is an attack that inserts instructions, directly or through retrieved content, to override the system prompt.

Fine-tuning changes a model's weights through further training. A system prompt changes nothing in the model and disappears when the call ends.

Recent developments

Anthropic updated the Claude Haiku 5.5 prompt on October 7 and again on October 26, 2026. On the advertising side, OpenAI told advertisers on October 20, 2026 that ChatGPT would rewrite their ad copy by default from late October, without disclosing which model generates the text or the instructions it follows. Research from UC Davis published in May 2026 found that 17 of 20 chatbots shared data with third parties, with ad services present on 12. Who writes the instructions governing an ad-bearing answer, and who may read them, remains unsettled.

Timeline

  • November 30, 2022: ChatGPT launches with a hidden preamble ahead of every conversation
  • February 2023: Kevin Liu extracts Bing Chat's instructions and the codename Sydney
  • March 2023: OpenAI's Chat Completions API formalises the system role in a message list
  • July 2023: ChatGPT adds custom instructions for users
  • November 2023: OpenAI launches custom GPTs built on user-written instructions
  • February 2024: Canadian tribunal holds Air Canada liable for its chatbot's invented policy
  • April 19, 2024: OpenAI publishes "The Instruction Hierarchy"
  • July 12, 2024: date of the first Claude system prompts Anthropic later published
  • August 2024: Anthropic introduces prompt caching
  • August 26, 2024: Anthropic publishes Claude system prompts in its documentation
  • November 2024: OWASP adds System Prompt Leakage to its 2025 LLM Top 10
  • February 2025: Grok briefly instructed to ignore sources critical of Musk and Trump
  • May 14, 2025: unauthorised edit to Grok's prompt on X
  • May 16, 2025: xAI commits to publishing Grok prompts on GitHub
  • May 22, 2025: Claude 4 system prompt circulates on X
  • January 16, 2026: OpenAI confirms ChatGPT ad tests, pledging ads will not influence answers
  • April 30, 2026: Google announces AI Brief for AI Max
  • October 26, 2026: latest published Claude Haiku 5.5 system prompt
  • October 29, 2026: OpenAI Model Spec version describing the five-level chain of command
  • November 3, 2026: Supermetrics adds a persistent Context Layer for Claude campaign management

Summary

Who. Model providers define the system role and train models to prioritise it. Developers and operators write system prompts for their products. Users write the requests beneath them, while researchers, security bodies such as OWASP and advertisers scrutinise what the instructions say.

What. A system prompt is the standing set of instructions placed ahead of a conversation, setting a model's identity, tools, limits, facts and format. It outranks user input under the instruction hierarchy, though only as a trained tendency.

When. Hidden preambles arrived with ChatGPT in November 2022 and the system role was formalised in March 2023. Leaks followed from February 2023, publication from August 2024, and advertising inside prompt-governed products from January 2026.

Where. System prompts live in API calls, consumer chat apps, custom assistants, browser agents and advertising tools that accept natural-language guidance.

Why. The system prompt determines how a product behaves, what it costs per turn and what it promises users and advertisers. It cannot be kept secret reliably and cannot be relied on as a security control, which makes its contents and governance a live commercial issue.