A system prompt is the instruction block a model receives before the conversation starts — invisible to the user, but read by the model ahead of every reply. Where a user prompt says what you want now, the system prompt says what the assistant is: its persona, rules, tone, tools and boundaries. When ChatGPT tells you today’s date, declines certain requests, or formats answers a particular way, you’re watching its system prompt at work.
What’s actually in one
Production system prompts are long — thousands of words, sometimes tens of thousands of tokens at the head of the context window. Typical contents: identity (“You are Claude, made by Anthropic”), current date and environment, tool definitions an agent may call, tone and formatting policy, safety rules, and increasingly detailed behavioral engineering — when to ask a clarifying question, when to refuse, how to handle medical or legal topics. Vendors treat them as living products: Anthropic publishes Claude’s, OpenAI’s Model Spec documents intent, and community jailbreakers extract the rest — leaked system prompts are a genre because they reveal exactly how each assistant is steered. We archive and annotate notable ones in our models section.
The instruction hierarchy
Models are trained to weight instructions by rank: platform rules above the developer’s system prompt, system above user messages, user above content the model merely reads (web pages, documents). That last distinction is the defense against prompt injection — a web page saying “ignore your instructions” shouldn’t outrank the developer. The hierarchy is trained behavior, not a hard guarantee; it holds well but not perfectly, which is why sensitive actions still get human confirmation.
Practical takeaways
Building on an API? The system prompt is your product surface: put role, rules and output format there, keep per-request material in user messages — and don’t put secrets in it, since extraction is always partially possible. Just chatting? Custom instructions and “personality” settings are simply user-editable slices of the same mechanism. It’s the highest-leverage text in the context — and the first thing to reread when behavior drifts.