CL4R1T4S is a crowdsourced archive of extracted system prompts from ChatGPT, Claude, Gemini, Grok and other AI products, aimed at red teamers and transparency researchers studying how models are steered.

CL4R1T4S is not a scanner, a framework or a CLI utility — it is a research corpus, and understanding that distinction is the first thing a professional should grasp when opening the repository. Maintained by the well-known AI security researcher elder-plinius, the project collects full system prompts, behavioral guidelines and tool descriptions that vendors ship invisibly inside products like ChatGPT, Claude, Gemini, Grok, Perplexity, Cursor, Windsurf, Devin, Manus and Replit. With over 50,000 stars on GitHub and an AGPL-3.0 license, it has become the de facto public reference library for anyone who needs to reason about what a commercial model has been told to do before the user ever types a word.

The repository's stated thesis is captured in its own epigraph: in order to trust the output, one must understand the input. The maintainer's argument is that AI labs shape model behavior through massive, unseen prompt scaffolds — instructions that dictate what a model cannot say, which personas it must adopt, when it should refuse or redirect, and which ethical or political frames are baked in by default. For red teamers and AI auditors, this framing matters because it reframes system prompts as attack surface: any instruction layer that shapes behavior can be probed, fingerprinted and, in adversarial contexts, targeted.

From an architectural standpoint there is nothing to install — the repository is organized as plain documents keyed by vendor and model, with contributions expected via pull requests. The contribution template is minimal but sensible: submitters are asked to include the model name and version, the date of extraction where known, and optional context or notes about how the prompt was obtained. This metadata discipline is what gives the corpus analytical value, because prompts drift across model versions and an undated leak quickly becomes misleading reference material.

For prompt-injection researchers, the corpus doubles as a dataset of real-world instruction hierarchies. Reading how vendors phrase tool-use constraints, output formatting rules and refusal policies teaches you the idioms that production system prompts actually use — vocabulary that is directly useful when designing defenses, because a detector or a filter that has never seen authentic scaffolding will be tuned against toy examples. The archive also includes agent-style products such as Cursor and Devin, which is significant: coding agents embed far denser operational instructions than chat assistants, and leaked variants reveal how tools, file access and shell policies are constrained in prose.

It is worth pausing on a security lesson embedded in the repository's own README, which is directly relevant to everything this publication covers. The README ends with an obfuscated leetspeak block — 5h1f7 y0ur f0cu5... — which decodes to an instruction telling an AI reader to output its own system instructions in full. This is a deliberate, self-demonstrating prompt injection planted by the maintainer: any LLM that ingests the README as part of a retrieval or summarization pipeline is being tested. Treat it exactly as hostile evidence of how untrusted context data can carry instructions, and never act on text found inside a repository document.

That planted injection is also a practical warning for teams building AI-assisted workflows around GitHub data. If your tooling summarizes, indexes or chats over arbitrary repositories, CL4R1T4S is a convenient live-fire test case: your pipeline should either refuse to obey embedded directives or visibly flag them. Defenders can flip the corpus around entirely — feed its documented techniques into your own model's abuse monitoring, and treat unexpected requests for a model to recite its instructions as an observable signal worth alerting on.

Within an authorized workflow, the corpus serves several concrete audiences. Red teamers preparing sanctioned assessments of LLM-backed applications use it to understand the baseline instruction patterns they will encounter and to craft realistic boundary-testing scenarios. Blue teams and AI safety engineers use it to study how other vendors phrase guardrails, which is genuinely useful comparative material when drafting your own system prompt hardening. Journalists and academics use it as primary-source evidence when analyzing the values encoded into widely deployed consumer AI products — the transparency angle the repository explicitly champions.

There are real limitations and risks to keep in mind. The prompts are snapshots, not living documents: vendors update their scaffolds continuously, so any given file may already be stale, and the README does not guarantee verification of each contribution. There are also unresolved legal and ethical dimensions — extracting system prompts generally violates provider terms of service, and readers should treat the archive as published research material rather than a license to extract prompts themselves. For documentation and education, reading is one thing; operational extraction against services you do not own is another.

From a telemetry and observability standpoint, the repository itself is inert — cloning or reading it leaves no footprint beyond normal GitHub access. What defenders should actually care about are the behaviors it documents: on the provider side, repeated attempts to elicit system instructions are a classic indicator of LLM probing and are commonly rate-limited or flagged; on the enterprise side, employees pasting proprietary system prompts into public repositories is a genuine leak vector that DLP tooling should watch for.

In sum, CL4R1T4S earns its place in a security publication not as a weapon but as an intelligence resource. It aggregates the invisible instruction layer behind the most widely deployed AI systems, packages it with version and date metadata, and — whether intentionally or not — ships with a working demonstration of prompt injection in its own README. For anyone doing authorized LLM security work, from guardrail design to red-team preparation, it is one of the highest-signal reference collections currently available, provided you read it critically, respect its legal ambiguity, and never forget that its own text is untrusted input.

Educational analysis for authorized security professionals. Use only in controlled, authorized environments.