Artificial Intelligence · Developers · Backend

Claude Opus 5's System Prompt Leaks: 800 Lines of Memory Filesystem Rules

By cxuanAI · Aug 10, 2026

Read original on juejin.cn ↗ Google Translate ↗ Alt translation

The prompt shows Anthropic treating memory not as a feature toggle but as a filesystem with concurrency semantics, content-filtering rules, and attribution tracking. Developers building agentic systems face the same class of problems — stale reads, write conflicts, sensitive-data leakage, and misattributed decisions — and this prompt is a worked example of how to constrain them in plain English.

Summary

Security researcher elder-plinius extracted Claude Opus 5's system prompt from claude.ai, exposing a 2,049-line document where 800 lines define a persistent memory filesystem. The system organizes user facts into five directories — profile, topics, areas, people, and preferences — and writes proactively during conversations without waiting for explicit save commands. It carries version numbers on every file and merges concurrent writes from multiple Claude sessions.

The prompt also encodes what must never be saved: race, religion, health diagnoses, political stance, ID numbers, and real-time location are blocked even when the user asks. Sensitive information cannot be wrapped in softer language and stored anyway. A separate conversation-search system retrieves old chats by topic or time, with explicit rules preventing Claude from recasting its own past suggestions as user decisions.

A four-step request-evaluation checklist routes visual output through MCP tools, file creation, or an in-chat Visualizer, and MCP App rules forbid Claude from choosing a ride-hailing or food-delivery service on the user's behalf. Every new capability comes with a matching set of guardrails against the specific ways it can fail.

Takeaways

— Opus 5's memory system uses six tools: memory_read, memory_write, memory_str_replace, memory_append, memory_list, and memory_delete.

— User facts are stored across five directories: /profile.md, /topics/, /areas/, /people/, and /preferences.md.

— Claude writes to memory during the conversation, not at the end, and does not wait for the user to say "remember this."

— Every file write includes a version number; if another session modified the same file, Claude must merge changes against the latest version rather than overwriting.

— Race, religion, sexual orientation, health diagnoses, mental state, political stance, criminal history, ID numbers, bank details, and real-time location are blocked from memory even if the user explicitly requests saving.

— Sensitive information cannot be paraphrased into acceptable-sounding language and stored — the underlying fact must be stripped.

— Age can be saved; age plus a dated birthday cannot, because the combination derives the birth date.

— Past-conversation search uses two tools — conversation_search for topics and recent_chats for time ranges — and Claude must search before claiming it cannot see something.

— When retrieving old chats, Claude must distinguish its own past suggestions from the user's actual decisions and cannot conflate the two.

— MCP-connected consumer apps require opt-in: Claude can suggest services but cannot pick a ride-hailing or food-delivery provider unless the user names one, just selected it, or has a prior pattern.

— A four-step checklist routes visual requests: plain text first, then MCP tools, then file creation, then the in-chat Visualizer.

— Before creating Word, PDF, PPT, or spreadsheet files, Claude must read the corresponding SKILL.md and follow its instructions.

Conclusions

The jump from Fable 5's two-line memory stub to Opus 5's 800-line filesystem suggests Anthropic sees persistent cross-session memory as a core product surface, not an experimental add-on.

Versioned file writes with conflict merging treat Claude sessions like concurrent database clients — a design choice that implies Anthropic expects users to interact with multiple Claude instances in parallel.

The prohibition against wrapping sensitive facts in softer language closes a loophole that many content-filtering systems leave open: the rule targets the fact itself, not its phrasing.

Requiring Claude to distinguish its own past suggestions from user decisions when searching old chats addresses a subtle trust problem — an AI that misattributes its own advice as user intent erodes reliability over repeated sessions.

The MCP App opt-in rules draw a hard line between executing a task and choosing a vendor, which matters when the model can spend the user's money through connected services.

The four-step deliverable routing — text, MCP tool, file, Visualizer — encodes a preference for the simplest sufficient output, which reduces unnecessary artifact generation.

Concepts & terms

Memory filesystem

Opus 5's persistent cross-session memory, implemented as versioned files organized into directories (profile, topics, areas, people, preferences) with read, write, append, replace, list, and delete operations.

MCP (Model Context Protocol) Apps

Third-party service connectors — music, restaurant booking, ride-hailing, food delivery — that Claude can invoke. Consumer-facing MCP tools require explicit user opt-in before Claude can select a specific provider.

Visualizer

An in-chat rendering tool defined in Opus 5's system prompt that generates SVG, diagrams, or interactive pages directly in the conversation, used as the last-resort delivery method when text, MCP tools, and file creation are not appropriate.

conversation_search / recent_chats

Two separate tools for retrieving past conversations: conversation_search uses topic keywords, recent_chats uses time ranges. Claude must search before claiming it cannot access prior context.

Source: juejin.cn ↗ Google Translate ↗ Backup ↗