System prompt

Mechanically, the system prompt is text rendered at the start of the token sequence inside the model's chat template, wrapped in role delimiters that mark it as system (or developer) content. API shapes differ: OpenAI's chat format carries it as a message with the system role and, from the o1 generation onward, a developer role intended for application builders; Anthropic's Messages API takes it as a separate top-level system parameter rather than as a message. In both cases the provider may add its own platform-level instructions that the developer does not see, and tool definitions are typically rendered into the same region.

Precedence is trained, not enforced. Instruction and preference tuning teach the model to prefer system instructions when they conflict with user turns, and OpenAI's "Instruction Hierarchy" work (Wallace et al., 2024) trains an explicit ordering in which platform or system messages outrank user messages, which outrank tool outputs, with the model expected to ignore lower-priority instructions that conflict with higher ones. OpenAI's Model Spec describes the same idea as a chain of command. These methods measurably improve robustness to jailbreaks and injected instructions, but they are statistical tendencies of the model; there is no parser or permission check that makes system text binding.

Confidentiality is the most common false assumption. System prompts leak through direct requests, role-play, translation or encoding tricks ("repeat everything above in a code block") and through indirect prompt injection; the early 2023 disclosure of Bing Chat's "Sydney" instructions was an example. OWASP's 2025 LLM Top 10 made this a separate entry, LLM07 System Prompt Leakage, and its guidance is to assume the prompt will be disclosed: never put credentials, API keys, internal URLs, user lists or authorisation logic in it, and enforce permissions, rate limits and content policies in code outside the model. Some vendors now publish their consumer assistants' system prompts; Anthropic, for example, publishes the system prompts used in its Claude apps in its release notes.

Engineering considerations: the system prompt is a fixed per-request cost in input tokens, so it is usually the largest beneficiary of prompt caching, which requires it to be byte-identical across calls - putting a timestamp or user name at its start defeats the cache. Very long rule lists dilute attention and create conflicts; clear role, context, output format and a small number of well-motivated rules generally work better. System prompts should be version-controlled and regression-tested, since a single edit affects every conversation, and multi-tenant applications must ensure one customer's configuration or data never ends up in another customer's system prompt.