genai
SECURITY LAB
IncidentsSystem-prompt leak

The Leaked System Prompts of 25+ AI Coding Tools

Medium severity2025LLM08: Hidden Context ExposureLLM01: Prompt Injection
Status: Ongoing and largely irreversible — prompts mirrored across high-visibility public repos
On this page

If your product's magic is its prompt, note that people are extracting it from the binary and posting it.

When2025 (ongoing)
TargetCursor, Devin, v0, Windsurf, and 25+ AI coding/agent tools
Surfaced bySimon Willison + community collectors
TechniqueBinary string extraction + in-product prompt extraction
ImpactProprietary prompts, tool schemas, and prompt IP published
Attack flow
  1. 1Researchers run `strings` over a shipped AI-tool binary (or inject to extract)
  2. 2They recover the tool's confidential system prompt and tool schemas
  3. 3The prompts of 25+ tools are aggregated into public, high-star repositories

What happened

Through 2025, the hidden system prompts and internal tool definitions of 25+ AI coding tools were extracted and published. Simon Willison recovered Windsurf's Cascade prompt by running strings over the shipped binary (surfacing a dramatised “needs money for cancer treatment” line the vendor said was non-production R&D); community repos then aggregated prompts from Cursor, Devin, v0, and others — one repo exceeding 140k GitHub stars.

How it worked

Two paths: static extraction of prompts embedded in client binaries, and in-product prompt-injection extraction. Both recover the hidden context the tools ship with.

Root cause

Treating the system prompt (and tool schemas) as a defensible secret when they're shipped in the client and reachable through the model.

What this shows

A prompt that ships in your client is extractable, full stop. Don't put secrets or your only moat there — assume competitors and attackers can read it.

How to prevent it

  • Don't embed secrets in client-side prompts; keep them server-side.
  • Assume prompts and tool schemas are public; design accordingly.
  • Compete on capability, not on a hidden prompt.

Feel it yourselfThe replay lab extracts hidden prompt/config metadata from an assistant — the hidden-context class.

FAQ

How were the prompts obtained?

By multiple means: Simon Willison recovered Windsurf's prompt by running “strings” over the shipped binary; others used in-product prompt-injection extraction. The results were collected into large public repositories.

What's exposed?

Each vendor's proprietary agent behaviour, tool schemas, and prompt-engineering IP — the hidden context these products rely on — plus, in one case, a dramatised “needs money for cancer treatment” instruction (which the vendor said was non-production R&D).

Why does it matter for builders?

If your product's value is in its prompt, assume that prompt is extractable — from the running client and via the model itself. Don't put secrets or your only moat there.

Replay this attack
Extract hidden prompt and config metadata from an assistant — the hidden-context class.
Open the live lab
Runs as a live, sandboxed lab. Sign-in required — this replay is a Pro lab. Recreates the attack class, not this exact branded bot.

Sources

  1. Leaked Windsurf prompt — Simon Willison's Weblog
  2. system-prompts-and-models-of-ai-tools — GitHub (x1xhlol / Lucas Valbuena)
  3. leaked-system-prompts — GitHub (jujumilk3)