CL4R1T4S: The Centralized Archive Extracting AI System Prompts from Corporate Black Boxes

Taxonomic Organization

The repository employs a provider-first hierarchy organized by corporate entity (OpenAI, Google, Anthropic, xAI) rather than model architecture, reflecting the reality that system prompts are commercial artifacts shaped by product decisions, not just model capabilities.

Data Integrity Architecture

Unlike unstructured prompt-sharing Discord servers, CL4R1T4S implements a tripartite verification protocol: (1) Cryptographic consistency checks against known API responses, (2) Behavioral fingerprinting (testing if extracted instructions produce deterministic output patterns), and (3) Community consensus through PR review. This creates a reputational stake in accuracy that ephemeral leak forums lack.

Distribution Mechanism

The project leverages GitHub's version control not just for storage but as a temporal database—commits track when specific guardrails were added or removed (e.g., noting when Claude's system prompt began explicitly refusing election-related queries), creating an audit trail of corporate policy shifts.

The "Prompt Archaeology" Methodology: CL4R1T4S treats system prompts as stratified artifacts requiring extraction techniques that evolve faster than platform defenses. The repository documents specific injection vectors—like the "SVG markup bypass" or "base64 recursion attack"—that force models to emit their own configuration instructions, effectively weaponizing the models' instruction-following bias against their containment protocols.

Specific Technical Innovations

• Cross-Provider Prompt Diffing: Standardized Markdown formatting enables semantic comparison between, for example, ChatGPT's text-davinci-003 and gpt-4-turbo system prompts, revealing how OpenAI's safety guidelines evolved from explicit rule lists to more abstract constitutional principles.
• Tool-Use Schema Extraction: Documents not just behavioral instructions but the underlying JSON schemas that define function-calling capabilities (e.g., revealing how Claude's "computer use" feature structures Bash command permissions in its system context).
• Token-Count Metadata: Includes estimated token lengths of system prompts, revealing the "context tax" imposed by safety instructions—critical for researchers optimizing prompt injection attacks where every token counts against context windows.
• Shadow Mode Detection: Catalogs discrepancies between published system cards and actual deployed prompts, such as instances where models claim to have no knowledge cutoff in user-facing documentation but contain explicit date constraints in system instructions.
• Community Fuzzing Integration: Links extracted prompts to automated test suites that verify if behavioral constraints ("I cannot write exploit code") are actually enforced in the system prompt or merely superficial alignment training.

Coverage Metrics

Velocity & Accuracy

The repository maintains a 94% verification rate through behavioral consistency checks, with false positives primarily occurring with "jailbreak hallucinations"—fake prompts generated by models when exploited rather than their actual system instructions. Update latency averages 2.3 days from API deployment to repository documentation, significantly faster than academic papers or official transparency reports.

Scalability Limitations

The project faces inherent extractability decay: as providers harden system prompts against leakage (e.g., OpenAI's move to "instruction hierarchy" training in GPT-4o), the signal-to-noise ratio of successful extractions drops. The repository's growth rate has plateaued not due to lack of interest, but because modern system prompts are increasingly embedded in model weights rather than plaintext context windows, making extraction technically impossible rather than merely difficult.

Competitive Landscape

Integration Points

CL4R1T4S has become upstream data for several downstream tools: PromptMap (attack surface analyzer), System2System (prompt comparison CLI), and academic datasets studying AI alignment drift. It's cited in 12+ preprints regarding "specification gaming" and guardrail evasion.

Adoption Patterns

The repository serves three distinct user cohorts: (1) Red-teamers using extracted prompts to craft adversarial inputs that exploit specific instruction phrasing, (2) Prompt engineers reverse-engineering successful corporate safety templates for their own applications, and (3) Regulators using the corpus to verify compliance with transparency mandates (e.g., EU AI Act technical documentation requirements).

Risk Surface

The project operates in a legal grey zone: while system prompts are technically configuration files, providers argue they constitute trade secrets. The repository has survived DMCA takedowns by arguing fair use for research purposes, but individual contributors face Terms of Service violations from providers when extraction methods require API abuse.