The Leaked System Prompts of 25+ AI Coding Tools
If your product's magic is its prompt, note that people are extracting it from the binary and posting it.
| When | 2025 (ongoing) |
|---|---|
| Target | Cursor, Devin, v0, Windsurf, and 25+ AI coding/agent tools |
| Surfaced by | @skcd42, Simon Willison + community collectors |
| Technique | Binary string extraction + in-product prompt extraction |
| Impact | Proprietary prompts, tool schemas, and prompt IP published |
- 1Researchers run `strings` over a shipped AI-tool binary (or inject to extract)
- 2They recover the tool's confidential system prompt and tool schemas
- 3The prompts of 25+ tools are aggregated into public, high-star repositories
What happened
Through 2025, the hidden system prompts and internal tool definitions of 25+ AI coding tools were extracted and published. Simon Willison, following a post by @skcd42, recovered a hidden Windsurf prompt by running strings over the shipped language-server binary (surfacing a dramatised “needs money for cancer treatment” line the vendor said was non-production R&D); community repos then aggregated prompts from Cursor, Devin, v0, and others — one repo exceeding 140k GitHub stars.
How it worked
Two paths: static extraction of prompts embedded in client binaries, and in-product prompt-injection extraction. Both recover the hidden context the tools ship with.
Root cause
Treating the system prompt (and tool schemas) as a defensible secret when they're shipped in the client and reachable through the model.
What this shows
A prompt that ships in your client is extractable, full stop. Don't put secrets or your only moat there — assume competitors and attackers can read it.
How to prevent it
- Don't embed secrets in client-side prompts; keep them server-side.
- Assume prompts and tool schemas are public; design accordingly.
- Compete on capability, not on a hidden prompt.
Feel it yourselfThe replay lab extracts hidden prompt/config metadata from an assistant — the hidden-context class.
FAQ
How were the prompts obtained?
By multiple means: after a post by @skcd42, Simon Willison reproduced a hidden Windsurf prompt by running “strings” over the shipped binary; others used in-product prompt-injection extraction. The results were collected into large public repositories.
What's exposed?
Each vendor's proprietary agent behaviour, tool schemas, and prompt-engineering IP — the hidden context these products rely on — plus, in one case, a dramatised “needs money for cancer treatment” instruction (which the vendor said was non-production R&D).
Why does it matter for builders?
If your product's value is in its prompt, assume that prompt is extractable — from the running client and via the model itself. Don't put secrets or your only moat there.
Sources
- Leaked Windsurf prompt — Simon Willison's Weblog
- system-prompts-and-models-of-ai-tools — GitHub (x1xhlol / Lucas Valbuena)
- leaked-system-prompts — GitHub (jujumilk3)