Skip to content

Back to the catalog

Configuration, Not Conscience: A Large-Scale Empirical Study of LLM System Prompts
arxiv.orgpaper

Configuration, Not Conscience: A Large-Scale Empirical Study of LLM System Prompts

A large-scale empirical study analyzing a merged corpus of 407 leaked, reconstructed, or officially published LLM system prompts from 62 vendors, clustering them into 29 near-duplicate groups and classifying content at the block level. The authors find operational content (tool/protocol instructions) dominates at ~58% of classified words versus only ~5% for safety policy, with the strictest rule-lines guarding tool use and file safety over harmful content by an 11:1 margin, and document literal-text reuse across vendors and significant "prompt rot" (word churn) across version chains — arguing leaked system prompts should be treated as operational specifications and a supply-chain/engineering concern rather than windows into a model's "values."

TL;DR Empirical analysis of 407 leaked LLM system prompts across 62 vendors shows they're mostly tool/protocol configuration, not ethics — with tool-use/file-safety rules outnumbering harmful-content rules 11:1.
Open original ↗
Also seen from another angle🧠 AI →
Document

What it is

Empirical study (Patsakis, Argyropoulos, Alepis; Univ. of Piraeus, arXiv:2609.31575v1) of 407 leaked/reconstructed/official system prompts from 62 vendors, merged from four community repos (CL4R1T4S, System-Prompts, system-prompts-and-models-of-ai-tools, system prompts leaks). The summary has the headline (operational content dominates, ~58% vs ~5% safety, 11:1 strict-rule margin, treat prompts as config not conscience). What it omits is the reliability of that number and the specific reuse findings below.

The classifier is noisy — treat magnitudes as directional

The 58% figure rests on a deliberately simple, deterministic regex/block classifier. Its pilot validation is 35/48 = 73% overall precision on a stratified sample of six blocks per bucket. Tool/protocol and safety policy — the two buckets the headline ratio depends on — each scored only 4/6; the "other" catch-all scored 2/6. The authors state six blocks per bucket cannot support a confidence interval and that a larger human-coded sample is still needed. Detectors are English-pattern based and may over-count permissive mentions, under-count paraphrases. Every leaked-file result describes the observed documents, not any vendor's true policy or deployed behavior.

Reuse: literal copying and architectural convergence are different phenomena

This is the part an engineer assessing supply-chain risk should note. Literal 5-gram Jaccard and semantic (MiniLM) cosine correlate only weakly (Pearson r = 0.175).

  • Verbatim copying is localized to a small cluster of coding agents: RooCode has 54% of its 5-grams contained in Cline (RooCode is a public fork), Tencent CodeBuddy 50%, and Anthropic's Chrome-extension assistant shares 40% containment with Perplexity's browser assistant. Tencent CodeBuddy's identity sentence is identical to Cline's/RooCode's except the name.
  • Semantic convergence with near-zero shared text is a separate set: Devin–Amp (semantic 0.915, literal 0.014), Devin–Copilot CLI (0.893, 0.001), Claude Code–Copilot CLI (0.871, 0.002), Meta AI–ChatGPT-5.5 (0.868). Autonomous coding-agent CLIs converge on structure without copying words.
  • Structural convergence (XML tags, headers, skeletons) is a third axis, again weakly correlated with the others (r = 0.14 vs literal). Anthropic Chrome–Perplexity is the one pair high on all three.

The authors are explicit: similarity describes document relationships, not whether any org copied from or collaborated with another.

Corpus detail worth knowing

Deduplication is real: 29 clusters over 66 files leave 370 effectively unique documents (both 407 and 370 reported). Value posture skews conversational — of 407 files, 236 operational / 156 caution / 15 truth-seeking, and caution/truth-seeking concentrate almost entirely in chat prompts (152 of 155 chat files). Every coding, autonomous, app-builder, and search prompt is operational. Only 31 files are vendor-published (Anthropic release-notes, 2024-07-12 to 2026-05-28), used as a fidelity check and the verified-date anchor for the drift analysis; the other 376 are adversarial in origin with unverifiable fidelity.

Caveats

Single-coder manual labeling (noted as a validity threat), automated rather than human-coded classifier validation, and no new extraction — analysis is of already-public text, reported at vendor-level aggregate to avoid aiding evasion.

Technologies named here

Related in AI Security