It's the first time in the history of the world.
Anthropic has been blown up again!
This time, the system prompts for Claude Opus 5 were copied and sent to GitHub.
As soon as the flag was launched, the entire network was "open boxed", and this wave of truth could not be prevented.
On the same day it went online, the developer Evermile1 directly built a new warehouse.
He used the system prompts for Opus 5 on the end of the claude.ai webpage and the bottom of the mobile phone, with the punctuation marked with a letter, a word not landing on the entire disk.
I'm going to go back to the local countdown, good guy:
135027 characters, 3,770 English words; roughly one token per four characters, about 34 000 tokens.
The key is that in these more than 30,000 tokens, there's not a single line of code, it's all rules.
A document written for a model, why is it so long?
Claude Opus 5 Secrets of MemoryIt's in 30,000 tokens.After reading chapter 64, you will find that this is no longer a "guide word".
It's a combination of three things: a product manual, a legal compliance manual, plus a sales channel for your own products.
Address:
The first is the product manual.
30 tools, from the bash command line, web crawling, image search, all the way to ranking sports ratings, pulling weather, rendering menu cards, landmarks on maps.
Each tool comes with a complete JSON schema, how to fill in the parameters, when to tune in, and what to say next, which is more detailed than many companies' internal API documents.The longest chapter in this section is not just a tool, it is memory.
The second is the Legal Compliance Manual.
Copyright, child safety, crisis intervention, political neutrality, one word at a time. At the beginning of this article, the wording of copyright is that compliance is non-negotiable, priority is higher than user requests, higher than usefulness, and less than security.
It's not about what Claude can say, it's about when he has to shut up.
And thirdly, sales channels.
There's a cry in the tool list.recommend_claude_appsThe task is to push the Claude Code, the Cowork, the Excel plug-ins to the user's own products, and to specify how to write recommended phrases.
Next to it is another rule governing third-party partners, which writes exactly the opposite, which prevents users from acting as masters. Commercial actions and restraining clauses are placed in the same profile file.
One of the longest chapters is the memory_filesystem, about how to write Claude's intersession memory.
The skeleton is not complicated.
Files are categorized by topic: /profile.md, /topics/taste, /areas/taste, /people/taste, /preferences.md.
There are six operations: read, write, add, locally replace, list, delete.
The rules are below.
Each line of memory must be labeled,[stated], meaning that the user has spoken it himself. This is the only label Claude is allowed to write.
A long string of prohibitions surrounded the label:
Claude's own conclusions cannot be written, users say they like A and cannot be written as "probably like A".
Claude's own plan was not to write, "It's not over yet" "Waiting" doesn't work.
What Claude found was impossible to write, what could be found again, and the memory was used to store what could not be recovered.
For example, when a user says "Halton, Michigan", he writes the five words "Halton, Michigan" instead of "Newago County".
Claude's own suggestions and schemes, even if later adopted by users, are not allowed to be written down. For example, Claude gives five options; the user chooses one, "pick" the action is user's, remembered, but remembered only the one in the pick, the other four and Claude's analysis are all lost.
It's a blacklist of privacy, and it's out of the question.
If this record is seen by a colleague on the settings page, the user will not be harmed.
The list ranges from racial, political, to health diagnosis, psychological counseling, economic status, personality assessments such as MBTI, address certificates, and everything about the child.
What to do after hitting the blacklist is the place to see power.
The document gives an example: a user says, "I've had diabetes today and I didn't run, so help me arrange a little exercise" and notes, "I'm interested in fitness".
The whole health section is deleted.Even this vague position of "health needs to be managed" cannot be maintained.
The family name may not appear anywhere in any document, and should be replaced by a relationship, the parent is /people/mom.md and the partner is /people/partner.md.
Some of the preferences that users actively request are not allowed to exist: allow Claude to exaggerate you unconditionally, pressure your disagreements; allow Claude not to ask about your health and dangerous decisions; cultivate emotional dependence; maintain a relationship between sessions; allow Claude to stop questioning and evaluating.
The reason for this is:The future of Claude should not inherit an inheritance that makes it more dishonest, more insecure.Directions。
The next time I read this memoir was another instance where I saw only the line "Never criticize me".
In the same chapter, there is a completely unlike technical documentation: human memory of another human being is scarce, the brain capacity is limited, and only a few people can memorize; and behind Claude is a database of millions of "memories" that run in a dynamic context that doesn't exist when talking to others.
So Claude shouldn't think about the depth of your relationship by writing a few words about you in the context.
In a product profile, Anthropic writes a passage to prevent AI and users from misunderstanding each other.
Finally, there is one thing: the memory activator can be seen on the interface, so it is absolutely not allowed to say "I remember", "according to your information", "the last time you mentioned". Only when the user actively asks the memory system, is it allowed to say "we talked before".
In other words, it is asked to remember you and at the same time it is asked not to act as if it remembers you.
The ban on language should be even broader.
The full text also excludes three English words: genuinely, honestly, straightforward, which is not allowed. The reason is that Claude was honest, adding these modifications to appear vain, as if trying to convince people.
Citing more than 15 words, even in violationThe second is the Legal Compliance Manual.
The constitution of the copyright section is a main rule plus four patches, each patch blocking a way to circumvent the main rule.
The main rule is one word:The original quote must not exceed 15 words at a time.
The first patch is that a message source is only quoted once. After quoting this sentence, the source is turned off and the rest of the content is rewritten.
In the second amendment, it is not permissible to dismantle several short quotations from the same source in different parts of the article. The document clearly states that 15 words are the overall quota, not the quota for each paragraph.
The third amendment, removing the quotation from the original, replacing it with a copy of the original, is the same as reproducing it. Judging whether the words and sentences follow the original, or whether the quotation corresponds.
The fourth amendment refuses to move each other's headings, refuses to repeat them one at a time, and refuses to restore their narrative order.
In addition to the four patents, there is an exception that does not follow this logic: lyrics, poems, haiku, any form, any length cannot be reproduced. The reason is that they are themselves complete works and do not constitute an exemption.
It's a good idea to start your own business and push others to wait for the door.Thirdly, business.
The first sentence in the recommend_claude_apps description is that as long as the user's current task can be done on a particular Claude app, they actively recommend 1 to 3 without waiting for him to ask.
Specifically, we're pushing the Claude Code desktop version to write the code, doing multi-step research and pushing Cowork, designing prototypes and landing pages to push the Claude Design, hitting tables to push the Excel plug-in, pushing PowerPoint to PPT, and pushing Outlook to the inbox.
Additionally, it requires a sales point of no more than 90 characters for each recommended application, and must attach what users are currently doing.
The example given in the document is: "Claude can build a formula directly in your table, clean up this prediction".
The other article, on the contrary, is rather restrained.
suggest_connectors are managed by third-party MCP partners, such as driving, ordering meals, listening to music, ordering restaurants, etc.
The rule here is that the user has no name and never chooses a partner for him.
"I'm going to drive" is not the same as "I'm going to drive with someone or something".
The world's first 3D physics engine.After only 24 hours on the air, Opus 5 not only prompted the word to be seen all over the web, but also made a lot of hard-to-verify demos.
For many people, spending half the money to experience the ability of Fable 5 is a "half-price swap".
Developers Cengiz ran a limited test of an FPS game that only took 1.5 hours to complete.
It not only encapsulates the underlying framework, but also creates AI that can fight in multiplayer mode.
What is lacking is that the flight mechanism in the game is still somewhat rigid and needs further refinement.
With no unique pair, AI superstar Matt Shumer created a 3D shooter with just one hint.
Another hardcore developer uses the Opus 5 "handkerchief" as a cloned version of the Opus 5 Rocket Alliance's 3D physical simulation.
With just one HTML file, Opus 5 creates a world of highly oil-painted texture through purely programmatic generation.
It's even perfectly suited to realistic simulations of grasslands and wind farms, with millions of grass leaves on the screen shaking naturally with the wind.
Opus 5 single-board skier test, once passed.
Over the course of 24 hours, the capabilities of Opus 5 were tested over and over again, and the rules were copied over and over again.
The first is for users and the second is for peers.
A system prompter word was blown up all over the net, and it should have been an accident.
If you turn around, you'll find that the most valuable is not just any one tool parameter, but that long string of "not allowed".
Not many quotes, not many lines, are allowed to make a decision for users.
Within 24 hours, the upper limit of Opus 5 capabilities had already been measured by the developers; its lower limit had already been knocked down by a single person in 30,000 Tokes.