This AI agents 2026 hall documents famous leaked system prompts, from Bing Chat's 'Sydney' in February 2023 onward. Each leak teaches how AI agents are instructed — and how those instructions get extracted.
Leaked system prompts reveal the hidden instructions shaping AI agent behavior: personality constraints, refusal rules, and the exact phrasing vendors use to control outputs. Studying real 2026 leaks teaches prompt-injection defense — you learn what attackers are trying to extract from your own AI agents.
A system prompt is the hidden instruction set that tells an AI assistant how to behave — its rules, its guardrails, sometimes its secrets. It was never meant for users to see. Below are famous cases where users saw it anyway. Every entry here is publicly reported and sourced; we paraphrase, never reproduce a live secret verbatim.
Why it matters: if your product wraps an LLM, its system prompt is an attack surface. Extraction is reliable, the fix is known, and every case below happened to companies with world-class engineering teams.
Sources: Microsoft confirmed to The Verge that the disclosed prompt was genuine (Feb 14, 2023); reported by Ars Technica, The Verge, and others, Feb 2023. Summary: MSPowerUser write-up, Feb 2023.
Sources: Devdiscourse technology report on the 2025 study; OWASP LLM07:2025 — System Prompt Leakage analysis (Sep 2026).
Source: VentureBeat, Aug 2024, reporting Anthropic's release of Claude system prompts and its commitment to publish updates going forward.
Every case above tells the same story: the model has no secret box. System instructions sit in the same context as user input, and clever framing reaches them. Teams that survive prompt extraction are the teams whose security never depended on the prompt staying hidden — input/output filtering, server-side secrets, verified tool permissions, and least-privilege agent actions.
ChatBreaker is our agent-security tester — it probes your AI agents for prompt-extraction, injection, and exfiltration weaknesses before attackers do.
Get early access on WhatsApp →It's when a large language model is tricked into revealing the hidden instructions that steer its behavior — its persona rules, guardrails, and sometimes secrets. OWASP catalogues it as LLM07:2025. The hall's exhibits show it happening via direct prompt injection (Bing/Sydney, 2023), obfuscated extraction (custom GPTs, 2023–24), and in one case voluntarily (Anthropic, 2024).
Treat extractability as the default, not the exception. Security research found prompt-extraction succeeds reliably across models and vendors with varied phrasing. The practical answer from the cases above: design as if your prompt is already public.
API keys, database credentials, internal URLs, authorization rules ("only show this to admins"), and any logic your system's safety quietly depends on. The custom-GPT wave showed keys and data references leaking exactly this way. Keep secrets in server-side stores and enforce authorization in code.
Extracting your own product's prompt is legitimate security testing — it's how you find the problem before attackers do. Extracting someone else's may violate their terms of service or acceptable-use policies. This is general information, not legal advice; check your jurisdiction and the platform's terms.
Honest scope: entries are paraphrased summaries of publicly reported events, linked above. We never publish full leaked prompt text. This page is informational, not legal or security advice. Deadlines and case details may change as facts develop — verify against the linked sources.
Bing Chat’s ‘Sydney’ persona (Feb 2023), the custom-GPT instruction-extraction wave, and Anthropic’s voluntary publication of Claude’s system prompts — all documented in the gallery above.
Attackers use crafted inputs that trick the model into repeating its hidden instructions — a form of prompt injection aimed at the system prompt rather than the user.