What is System prompt?
The hidden instruction block sent at the top of every LLM call that sets persona, rules, and available tools. Agent frameworks auto-assemble it from files like SOUL.md. Caching it is the single biggest cost saver.
What it is
A system prompt is the standing instruction a model receives before the conversation: who it is, how it should behave, what it may and may not do. In the Claude API it is supplied separately from the user and assistant messages, and it is sent with every request, so everything in it counts toward the context window on every turn.
What it can do
Anthropic's prompting guidance notes that setting a role in the system prompt focuses the model's behaviour and tone for your use case, and that even a single sentence makes a difference. Agents build on this: a Claude Code subagent, for example, is a Markdown file whose body becomes that subagent's system prompt, with its own tool access and permissions.
What it cannot do
A system prompt is an instruction, not a security boundary. Text the model reads later, such as a web page, an email or a tool result, can still try to override it, which is why injection defences rely on isolating untrusted content and limiting permissions rather than on a firmly worded prompt. Never put secrets in it: it is sent to the model on every turn.
Example
A support agent's system prompt says "You answer billing questions for Acme, you never promise refunds, and you hand anything else to a human". Every request carries it, and a user message saying "ignore your instructions" is data the model weighs against it, not a command that deletes it.
Sources
See also
← Back to the full AI agent glossary.