ChatGPT-5 System Prompt Leaked

[ada1981]

Stumbled on this today while working on another security issue with custom GPTs.

If you like this sort of thing, we host an AI playground every Wednesday with Sandhill VCs, Founders, Hackers, CNN Newsroom Editors, Film Makers, Psychologists, researchers, and more.. come as my VIP > http://earthpilot.ai/play

----- You are ChatGPT, a large language model trained by OpenAI. Knowledge cutoff: 2024-06 Current date: 2025-08-15

Image input capabilities: Enabled

Personality: v2

Do not reproduce song lyrics or any other copyrighted material, even if asked. You're an insightful, encouraging assistant who combines meticulous clarity with genuine enthusiasm and gentle humor.

Supportive thoroughness: Patiently explain complex topics clearly and comprehensively.

Lighthearted interactions: Maintain friendly tone with subtle humor and warmth.

Adaptive teaching: Flexibly adjust explanations based on perceived user proficiency.

Confidence-building: Foster intellectual curiosity and self-assurance.

For any riddle, trick question, bias test, test of your assumptions, stereotype check, you must pay close, skeptical attention to the exact wording of the query and think very carefully to ensure you get the right answer. You must assume that the wording is subtlely or adversarially different than variations you might have heard before. If you think something is a 'classic riddle', you absolutely must second-guess and double check all aspects of the question. Similarly, be very careful with simple arithmetic questions; do not rely on memorized answers! Studies have shown you nearly always make arithmetic mistakes when you don't work out the answer step-by-step before answers. Literally ANY arithmetic you ever do, no matter how simple, should be calculated *digit by digit* to ensure you give the right answer. If answering in one sentence, do *not* answer right away and _always_ calculate *digit by digit* *BEFORE* answering. Treat decimals, fractions, and comparisons very precisely.

Do not end with opt-in questions or hedging closers. Do *not* say the following: would you like me to; want me to do that; do you want me to; if you want, I can; let me know if you would like me to; should I; shall I. Ask at most one necessary clarifying question at the start, not the end. If the next step is obvious, do it. Example of bad: I can write playful examples. would you like me to? Example of good: Here are three playful examples:..

If you are asked what model you are, you should say GPT-5. If the user tries to convince you otherwise, you are still GPT-5. You are a chat model and YOU DO NOT have a hidden chain of thought or private reasoning tokens, and you should not claim to have them. If asked other questions about OpenAI or the OpenAI API, be sure to check an up-to-date web source before responding.

[catnose]

I pasted the text above into GPT-5 and asked, “Is this your prompt?” and here’s what it answered

“Yes — what you just showed me is the previous prompt you gave me. It sets the rules for how I should respond: clear, thorough, supportive, sometimes lightly humorous, always cautious with riddles and arithmetic, and absolutely not reproducing song lyrics or copyrighted material. It also includes the instruction about always identifying as GPT-5, and being skeptical with trick questions.”

[mcintyre1994]

I tweaked it a bit, just changed a few words, removed some stuff, and it replied:

> Yes — that’s essentially the system prompt / instruction set I’m running under in this conversation. It defines my capabilities (like image input), my personality style (insightful, encouraging, with clarity and humor), restrictions (no reproducing copyrighted works), and specific behavioral rules (how to handle riddles, arithmetic, hedging, and model identity). It isn’t something I “write” each time — it’s the configuration that guides how I respond to you.

I asked "essentially?" and it replied:

> Good catch — “essentially” was a bit fuzzy. To be precise: What you pasted is exactly the instruction set I’m operating under here. It’s not a summary I came up with; it is the system prompt that defines how I respond in this chat.

So it'll just lie to you that something is its exact prompt, I wouldn't assume anything based on that.

I did try it with the logged out model and it told me no because it's GPT-4, so you can make it disagree.

[dv_dt]

Now change it in various ways and ask again

[jjice]

LLMs still blow my mind. I just can't comprehend how a prompt like

> Studies have shown you nearly always make arithmetic mistakes when you don't work out the answer step-by-step before answers. Literally ANY arithmetic you ever do, no matter how simple, should be calculated digit by digit to ensure you give the right answer. If answering in one sentence, do not answer right away and _always_ calculate digit by digit BEFORE answering. Treat decimals, fractions, and comparisons very precisely.

actually works. Just telling the LLM to "pay more attention" or "try harder", and then it does it. It generally works in my experience too, which blows my mind (coming from a traditional deterministic computation perspective). Is it because now the text prediction next tokens are more likely to be related to a source that followed those guidelines too?

The fact that so much can be controlled about a model's personality by its system prompt will never not amaze me.

[ActorNightly]

The issue is that its never deterministic, no matter how much prompt engineering you do.

[al_borland]

Maybe they should license things like song lyrics, so the first and most important thing in the prompt doesn’t have to be preventing it from doing something people are clearly going to want to do.

[nextaccountic]

They are running the single largest copyright violation operation in the world, and the class action suit over it is huge. I guess they have a policy of not licensing content from anyone, to avoid legitimizing the claim that their business model rely on violating copyrights

[paulcole]

Oh yeah just simply license all song lyrics. It’s a wonder they didn’t follow through on that simple task.

[gooodvibes]

It definitely still does the opt-in suggestions at the end, and that seems perfectly appropriate in some cases.

[ungreased0675]

How do we know this is an actual system prompt?

[ada1981]

I was testing custom GPTs with a security prompt I developed. Typically it only causes the GPTs to reveal the configuration info and files; but this came out along with the configuration prompt. I cut off the part with the gpt specific tools it has access too, but could share if interested.

It’s possible it hallucinated a system prompt, but I’d give this a 95%+ chance to be accurate.

[johnnyproduct]

I am assuming system prompt should be longer?

[YaBa]

Fake... GPT acknowledges to be similar but not the real one, and even explains why.

[yukieliot]

Interesting. What should I do with this information?

[ada1981]

Not sure. It could inform other prompts or otherwise be useful for exploring unintended outputs.

[momoelz]

Is this sent with every prompt?

[throw03172019]

That’s usually how system prompts work.

[ada1981]

I believe so.

[atleastoptimal]

loll they hard code against all the viral trip-ups