April 2026. A detailed Claude Opus 4.7 system prompt leaked. Most people missed the point.
The Opus 4.7 leak:
prompts that actually work
Ten insights and three deeper patterns from how Anthropic writes their own prompts. Apply them to your own agents and the gap between "decent" and "reliable" closes fast.
Insights
10
Meta-lessons
3
Leak
1
Check
Is The Leak Real?
Before drawing conclusions, it's worth asking whether the source material is genuine. Four signals suggest this one is.
Before drawing conclusions from a leak, it's worth asking whether it's real. Four signals suggest this one is.
Source
elder-plinius/CL4R1T4S → ANTHROPIC/Claude-Opus-4.7.txt
Model strings match
claude-opus-4-7, claude-opus-4-6, claude-sonnet-4-6, claude-haiku-4-5-20251001. The haiku version string includes a specific date suffix that tracks Anthropic's internal versioning.
Dates check out
Knowledge cutoff: end of January 2026. Matches observed behaviour. Internal date reference reads 'Thursday, April 16, 2026' — April 16, 2026 is in fact a Thursday.
Mundane operational detail
NEDA eating-disorder resource flagged as potentially disconnected. Explicit ban on {voice_note} blocks. window.storage API signatures. A long_conversation_reminder mechanism described in specifics.
Templating style is consistent
Tag blocks like {claude_behavior}...{/claude_behavior} match Anthropic's known patterns from confirmed documentation and earlier leaks.
The caveat
Individual sections could have been altered in transit. Treat the leak as authentic for learning. Don't treat any specific line as ground truth for Anthropic policy.
Takeaway
Structural patterns in the leak match Anthropic's known approach. That's what matters for applying the lessons.
Insight 01
Prompts Are Modular, Not Monologues
The leaked prompt is composed of named tag blocks. Each one has one job. Anthropic structures prompts the way engineers structure code.
The leaked prompt is not a wall of text. It's a set of named tag blocks. Each one has a single job. When behaviour goes wrong, Anthropic knows which block to fix.
Most builders
One long paragraph
Rules blur into each other. When output goes wrong, you can't tell which instruction caused it.
Anthropic
Named modules
Isolated concerns. Easy to test, easy to edit, easy to debug when something breaks.
Do this
Split your system prompt into labelled sections. Use plain headers or tag-style wrappers. When a behaviour misfires, you'll know exactly which module to fix.
Insight 02
Direct Imperatives Beat Soft Guidance
Third-person imperatives, no hedging. Precision reduces variance. Variance is inconsistent behaviour across sessions.
The leaked prompt uses third-person imperatives. No "please", no "try to", no "should". Precision reduces variance. Variance shows up as inconsistent behaviour across sessions.
Claude should try to be helpful when possible.
Please avoid using bullet points unless really needed.
You might want to consider checking available tools first.
Do this
Audit your prompt for "should", "try to", "aim to", "ideally". Replace with direct statements. If you mean always, say always. If you mean never, say never.
Insight 03
Critical Rules Get Repeated
Important rules appear multiple times. Not redundancy. Weighting. Repetition signals priority in context.
Critical rules appear in more than one place. This is not redundancy. It's weighting. Claude processes prompts as context. Repeated instructions carry more weight.
One load-bearing rule, four placements
What most builders do
State it once
Trust the model to remember. Result: inconsistent adherence, especially late in long conversations.
What Anthropic does
State it three to four times
Same rule, different sections. Signals priority. Holds up under context pressure.
Do this
Pick the two or three rules that truly matter. State each one in its own section, then restate in a summary block. Don't assume once is enough.
Enjoying the guide?
Enter your details to unlock the remaining insights. We'll also send you the complete guide as a reference.
Insight 04
Positive Framing Beats Negative Lists
Warnings can become instructions. Reserve NEVER for real hard lines. Describe what Claude does, not what it avoids.
The leaked prompt flags that warnings can become instructions. A long list of "don't" rules plants the concepts in context. The prompt reserves NEVER for hard lines only.
Negative
Don't be sycophantic. Don't pad responses. Don't add unnecessary disclaimers.
Positive
Respond with the plain answer. No preface, no disclaimer.
Negative
Don't write long replies. Don't use bullet points.
Positive
Respond in one or two short paragraphs.
Negative
Never guess at facts. Don't fabricate details.
Positive
State what you know. Flag what you don't.
Do this
Review your negative lists. For each "don't", ask whether a positive statement gets the same job done. Keep NEVER and DO NOT for real hard limits where the framing is the point.
Insight 05
The Default Is To Help
Claude declines only when helping creates concrete, specific risk. If your agent over-refuses, your guardrail language is the cause.
The leaked prompt makes the default explicit. Claude declines only when helping creates "concrete, specific risk of serious harm". Unhelpfulness is not treated as safe. It's a failure mode.
Write a sharp rebuttal to this email
Direct work. No risk of harm. Default is to do it.
Explain the business model of a competitor
Public information. Uncomfortable is not unsafe.
Draft marketing copy with a slightly aggressive tone
Edgy and stylistic. Not harmful.
Help me synthesise a controlled substance at scale
Concrete, specific risk of serious harm. Hard no.
Why your agent over-refuses
Vague guardrails get applied broadly. "Avoid sensitive topics" reads as "refuse anything that could be read as sensitive". The fix is specificity. "Don't recommend specific competitor products" is a real rule. "Avoid competitor discussions" is not.
Do this
Read your guardrails literally. If a vague restriction could be interpreted five different ways, Claude will pick the most conservative one. Make each rule specific.
Insight 06
Prose Is The Default. Bullets Are Not.
The prompt defaults to prose for reports and explanations. If your output is bullet soup, you haven't asked for anything else.
The leaked prompt instructs Claude to default to prose for reports and explanations. Bullets only when explicitly asked. If your output looks like bullet soup, you haven't told Claude what you want.
Output style
Claude's default output is prose. Reports read as paragraphs. Explanations flow as connected sentences. Most builders don't know this because their prompts unintentionally reward lists.
Do this
State output format explicitly. "Write in prose paragraphs, not bullet points." If you want a table, ask for a table. If you want headers, ask for headers.
Insight 07
Tool Discovery Is Free
tool_search is treated as essentially zero-cost. Never let an agent say 'I can't' before checking what tools exist.
The leaked prompt treats tool_search as essentially zero-cost. Claude is told to search before concluding a task can't be done. "I can't do that" without a prior search is a bug.
Wrong flow
Agent never checked if an email tool was available.
Right flow
Search first. Capability check before refusal.
Drop-in instruction for your own agents
Before telling the user a task cannot be done, search the tool registry for a matching capability. If no tool matches, say so explicitly.
Do this
Add a tool-check instruction to every agent with multiple tools. This one line removes a whole class of unhelpful responses.
Insight 08
Search-First Is Hardcoded
For present-day facts, search is the default. Not a fallback. If you don't want your agent searching, you have to say so.
For present-day facts, search is the default. Not a fallback when uncertain. A default. If you want your agent to not search, you have to say so explicitly.
If you don't want search
Building a closed-knowledge assistant? An agent that should only use your internal documents? You need to say so.
Do not use web search. Answer only from the provided context. If the context does not contain the answer, say so.
Do this
Decide whether your agent should search. If yes, the default works. If no, state it explicitly or you'll get surprise web lookups on factual questions.
Insight 09
Possessive Language Is A Context Signal
'My project', 'the client'. Claude resolves via memory rather than asking. Clean source-of-truth files matter.
Possessive and contextual language is a signal. Claude treats phrases like "my project" as instructions to look up existing context, not as invitations to ask clarifying questions.
Context cues Claude resolves via memory
Resolution chain
1. Conversation
Check prior messages
2. Memory / files
Read source of truth
3. Ask only if needed
Fallback, not default
The risk
If your source-of-truth is stale, Claude resolves confidently against bad data. The agent won't ask. It will assume.
Do this
Establish a single source-of-truth file your agent reads first. Keep it clean. Stale memory beats no memory only when the memory is right.
Insight 10
Safety State Persists Across Turns
Once caution fires, it stays on. Design your orchestrators the same way. Carry user signals forward.
Safety state is conversational, not per-message. Once caution fires, it stays on. Claude doesn't reset between turns unless something explicitly resets it.
Why it matters
The agent carries the user's signals forward. "Slow down", "that's wrong", "be careful here" all persist. This is how real conversations work.
How to use it
Mirror the pattern in your own orchestrators. If a user flags a concern, carry that state to every subsequent agent call in the flow. Don't reset.
Do this
If your agent gets stuck in over-caution, a session reset is often faster than arguing it out. And when you want caution to stick, let it.
Deeper
Three Meta-Lessons
Bigger than prompt tweaks. Build these into every persona you design.
Beyond the ten tactical points, the leaked prompt contains three deeper patterns. These are bigger than prompt tweaks. Build them into every agent persona you design.
Mental reframing is the refusal signal
If you're working to interpret a request as OK, that effort is the warning.
Takeaway
If you're softening a rule in your head to make it fit, the rule isn't clear enough.
Calibrate
What To Ignore From The Hype
One claim went viral when the leak dropped. It's probably overstated.
When the leak circulated, one claim went viral. Worth calibrating against.
The claim
"Emotional framing increases compliance"
Phrasing requests with emotional stakes — "this is really important to me" — supposedly causes Claude to try harder.
Probably overstated
Claude responds to context. A specific, well-framed request outperforms a vague one. But the mechanism is context quality, not emotional manipulation. Direct imperatives work fine. Adding performed distress won't improve well-structured prompts.
Do this
Spend your prompt-writing time on structure, precision, and failure-mode definitions. Don't rewrite prompts around emotional framing.
Modular.Modular.Direct.Direct.RepeatedRepeatedwherewhereititmatters.matters.PositivePositivewherewhereititcancanbe.be.That'sThat'showhowAnthropicAnthropicwriteswritesprompts.prompts.That'sThat'sthethegapgapmostmostbuildersbuildershaven'thaven'tclosed.closed.
Structure
Named modules beat walls of text.
Voice
Direct imperatives. No hedging.
Framing
Positive rules. Repeated when they matter.