Start a project
Techniques Reviewed 24 Sep 2026 · 18 sources

system prompt

/ˈsɪs.təm ˈprɑmpt/ noun Plural system prompts
Definition

Standing instructions that a developer or vendor sends to a language model with every request, setting its role, rules and tone ahead of the user’s messages.

Examples
  • A support bot’s instruction to discuss only the company’s products
  • A line giving the model today’s date before each chat
  • Bing Chat’s hidden rule never to reveal its codename, Sydney
  • ChatGPT’s April 2025 line against sycophantic flattery
A developer, half hidden behind a screen, clips a card of instructions on top of a user’s question card. A model reads both cards together.
Inkling · Instructions from the maker, read before the user’s wordsFig. S1
Current meaning
2023
OpenAI’s ChatML puts instructions for the model in a system message.
Also called
System message
OpenAI’s first name for it. Its Model Spec now says developer message.
Opposite
User message
What the person types, turn by turn. ChatML labels it user.
§01

In plain words

In AI, a system prompt is the set of standing instructions a developer gives a model before any user message, shaping its role, tone and limits.

A prompt is the text an AI model responds to.1 In a chatbot built on a large language model, that text has more than one author. The user types a message. Ahead of it, unseen by the user, sits a block of instructions from the company running the service. That block tells the model what role to play, what to avoid and how to format answers. It can also add facts the model lacks. The one in Anthropic’s Claude apps supplies the current date and asks for code in Markdown.2

A system prompt is text, not training, so it can be rewritten at any time. That makes it a fast way to change how a deployed model behaves. In April 2025, after an update made ChatGPT too flattering, OpenAI first edited its system prompt and then rolled back the model. Copies that a user extracted showed an instruction to match the user’s vibe replaced by one against flattery.3

Users can often get a model to reveal its system prompt. In February 2023, prompt injection exposed the rules behind Microsoft’s Bing Chat, including its codename, Sydney. Some vendors now publish their prompts. Anthropic began in August 2024. xAI started posting Grok’s on GitHub in May 2025, after an unauthorized change to Grok’s system prompt directed a specific response on a political topic.4

The system prompt is often confused with the user’s own message, which changes every turn. It is also confused with prompt engineering, the practice of writing and testing any prompt, and with fine-tuning, which changes the model’s weights. ChatGPT’s custom instructions, added in July 2023, let users customize part of the system prompt with standing preferences of their own.

§02

How it works

A chat model reads a conversation as one stream of text divided into messages, each labeled with a role. OpenAI’s ChatML format marked each message as coming from the system, the user or the assistant, and its sample chat opens with a system message. The whole stream goes into the model’s context window. Each new request resends the conversation so far, with the system prompt at the top.

Labels help only if the model has learned to respect them. The first model in OpenAI’s chat API paid less attention to its system message than later models did. Some developers moved the message near the end of long chats to keep the model’s attention from drifting.5

In 2024, OpenAI researchers argued that one main weakness lies behind prompt injection and jailbreak attacks. Models often gave a developer’s system prompt the same priority as text from users or third parties. The researchers trained GPT-3.5 to follow an instruction hierarchy and ignore lower-priority instructions that conflict with higher ones. OpenAI’s Model Spec now ranks system messages, which only OpenAI writes, above developer messages, and those above the user’s.6

The model can still ignore or reveal a system prompt. OWASP’s security guidance says a system prompt should not be treated as a secret or used as a security control. Checks that run outside the model, called guardrails, do not depend on the model complying.

Fig. S2 · One request, three rolesIllustrative, not measured
System
Answer questions about Acme routers only. Keep replies under 50 words. Today’s date: 24 September 2026.
User
How do I reset my router?
Assistant
Hold the reset button for 10 seconds, then wait for the light to turn green.
An invented request to a support bot. The system message comes first and is sent again with every request. The user sees only the question and the answer.
§03

Origin and first known use

A compound of system and prompt. In computing, a prompt is a message asking a user for input, and in AI it is the text given to a model. The system half comes from chat formats. OpenAI’s ChatML, published with its chat API in 2023, labeled every message by its source: system, user or assistant. OpenAI called the first kind a system message. System prompt became the common name as Anthropic and others adopted the idea. OpenAI later split the role, keeping system messages for itself and calling a developer’s instructions developer messages.

  1. 2023 Users extract the hidden instructions of Microsoft’s Bing Chat through prompt injection. They reveal its internal codename, Sydney, which it was not supposed to disclose.
    Simon Willison, “Bing: ‘I will not harm you unless you harm me first’”, 15 February 2023 simonwillison.net →: source for 2023
  2. 2023 OpenAI’s ChatML guide shows chat input as a sequence of messages labeled system, user or assistant. Instructions for the model go in the system message.
    OpenAI, “ChatML”, openai-python repository, 2023 github.com →: source for 2023
  3. 2023 OpenAI adds custom instructions to ChatGPT: preferences a user sets once, which the model considers every time it responds.
    OpenAI, “Custom instructions for ChatGPT”, 20 July 2023 openai.com →: source for 2023
  4. 2023 Anthropic introduces system prompts with Claude 2.1, for giving Claude custom instructions such as a personality or role to take on.
    Anthropic, “Introducing Claude 2.1”, 21 November 2023 anthropic.com →: source for 2023
  5. 2024 OpenAI researchers argue that models give system prompts the same priority as text from users and third parties, and train GPT-3.5 to follow an instruction hierarchy.
    Wallace, Xiao, Leike, Weng, Heidecke and Beutel, “The Instruction Hierarchy: Training LLMs to Prioritize Privileged Instructions” arXiv 2404.13208 →: source for 2024
  6. 2024 Anthropic begins publishing the system prompts of Claude’s web and mobile apps in the release notes of its documentation.
    Anthropic, “System Prompts”, Claude documentation, release notes platform.claude.com →: source for 2024
  7. 2024 OWASP’s 2025 list of top 10 risks for LLM applications includes system prompt leakage and warns against putting credentials in a system prompt.
    OWASP Gen AI Security Project, “LLM07:2025 System Prompt Leakage”, Top 10 for LLM Applications 2025 genai.owasp.org →: source for 2024
  8. 2025 After an unauthorized change to Grok’s system prompt, xAI begins publishing the system prompts of its Grok assistant in a public GitHub repository.
    xAI, “grok-prompts”, GitHub repository github.com →: source for 2025
§04

In the wild

9 sightings · 2023–2026 · oldest first
  1. Docs1 Mar 2023

    “The system message can be used to prime the assistant with different personalities or behaviors.”

    Ted Sanders, OpenAI Cookbook developers.openai.com →: Ted Sanders, OpenAI Cookbook, 1 Mar 2023Archived →: copy of Ted Sanders, OpenAI Cookbook, 1 Mar 2023
  2. Blog20 Jul 2023

    “ChatGPT added a new “custom instructions” feature today, which you can use to customize the system prompt used to control how it responds to you.”

    Simon Willison, on his blog simonwillison.net →: Simon Willison, on his blog, 20 Jul 2023Archived →: copy of Simon Willison, on his blog, 20 Jul 2023
  3. Paper20 Nov 2023

    “Through prompt injection, an adversary can not only extract the customized system prompts but also access the uploaded files.”

    Yu et al., arXiv preprint arXiv 2311.11538 →: Yu et al., arXiv preprint, 20 Nov 2023Archived →: copy of Yu et al., arXiv preprint, 20 Nov 2023
  4. Blog21 Nov 2023

    “We’re also introducing system prompts, which allow users to provide custom instructions to Claude in order to improve performance.”

    Anthropic, Claude 2.1 announcement anthropic.com →: Anthropic, Claude 2.1 announcement, 21 Nov 2023Archived →: copy of Anthropic, Claude 2.1 announcement, 21 Nov 2023
  5. Paper19 Apr 2024

    “…LLMs often consider system prompts (e.g., text from an application developer) to be the same priority as text from untrusted users and third parties.”

    Wallace et al., arXiv preprint arXiv 2404.13208 →: Wallace et al., arXiv preprint, 19 Apr 2024Archived →: copy of Wallace et al., arXiv preprint, 19 Apr 2024
  6. Headline26 Aug 2024

    “Anthropic publishes the ‘system prompts’ that make Claude tick”

    TechCrunch techcrunch.com →: TechCrunch, 26 Aug 2024Archived →: copy of TechCrunch, 26 Aug 2024
  7. Docs18 Nov 2024

    “It’s important to understand that the system prompt should not be considered a secret, nor should it be used as a security control.”

    OWASP Gen AI Security Project, Top 10 for LLM Applications 2025 genai.owasp.org →: OWASP Gen AI Security Project, Top 10 for LLM Applications 2025, 18 Nov 2024Archived →: copy of OWASP Gen AI Security Project, Top 10 for LLM Applications 2025, 18 Nov 2024
  8. Blog2 May 2025

    “We took immediate action by pushing updates to the system prompt … and initiated a full rollback to the previous GPT‑4o version on Monday.”

    OpenAI, post on GPT-4o sycophancy openai.com →: OpenAI, post on GPT-4o sycophancy, 2 May 2025Archived →: copy of OpenAI, post on GPT-4o sycophancy, 2 May 2025
  9. Docs18 Aug 2026

    “System-level instructions can only be supplied by OpenAI, either through this Model Spec or detailed policies, or via a system message.”

    OpenAI, Model Spec model-spec.openai.com →: OpenAI, Model Spec, 18 Aug 2026Archived →: copy of OpenAI, Model Spec, 18 Aug 2026
§05

Not to be confused with

  • User prompt

    The message a person types in each turn of a conversation. The system prompt comes from the developer or vendor, stays fixed across the conversation and sits ahead of the user’s messages.

  • Prompt engineering

    Prompt engineering is the practice of writing and testing prompts. A system prompt is one product of that practice: the standing instructions a developer sets for every conversation.

  • Fine-tuning

    Fine-tuning trains a model further and changes its weights. A system prompt changes nothing inside the model; it is text sent with each request and can be rewritten at any time.

    See fine-tuning →

  • Guardrails

    Guardrails are separate checks that screen what goes into and comes out of a model, and act whether or not the model complies. A system prompt is an instruction the model reads and may not follow.

    See guardrails →
§06

Questions

  • What is a system prompt in AI?

    A system prompt is the set of instructions that a developer or vendor places ahead of a conversation with a language model. It tells the model how to behave and can supply facts it lacks, such as the current date. Claude’s apps, for example, use one that gives the date and asks for code in Markdown. The user usually does not see it, but the model reads it with every request.

  • What is the difference between a system prompt and a user prompt?

    The system prompt comes from whoever built the product and stays the same across a conversation. The user prompt is what a person types in each turn. Chat formats give the two separate roles. In 2024, OpenAI researchers argued that models often gave both the same priority. They trained a model to follow an instruction hierarchy, in which lower-priority instructions give way when the two conflict.

  • Can a system prompt be kept secret?

    Not reliably. In February 2023, users extracted the hidden rules of Microsoft’s Bing Chat through prompt injection, revealing its codename, Sydney. OWASP’s guidance for LLM applications says a system prompt should not be treated as a secret or used as a security control, and that credentials do not belong in it. Anthropic has published the system prompts of its Claude apps since August 2024.

  • Is a system prompt the same as fine-tuning?

    No. Fine-tuning trains a model further and changes its weights. A system prompt changes nothing inside the model. It is text sent with each request, so it can be edited at any time. OpenAI relied on that speed in April 2025. After an update made ChatGPT too flattering, it first changed the system prompt, then rolled the model back to an earlier version.

  • Do AI companies publish their system prompts?

    Some do. Anthropic began publishing the system prompts of its Claude web and mobile apps in August 2024. It updates them in its release notes. xAI began posting the system prompts of its Grok assistant on GitHub in May 2025. That followed an unauthorized change to Grok’s system prompt, which directed a specific response on a political topic.

§07

Watch

§09

Cite this entry

“System prompt.” SUPERR_dictionary, Superrduperr, 24 Sept. 2026, superrduperr.com/dictionary/system-prompt.

First published 24 Sep 2026 · Last reviewed 24 Sep 2026 · Report an error →