Every assistant runs on hidden instructions: who it is, what it may and may not do, which tools it can call, how to format output. User messages arrive on top of that. Products like Claude Code are, to a meaningful degree, an elaborate system prompt around a model — which is why leaked system prompts get read like source code.

Models are trained to weight system instructions above user ones, but that hierarchy is enforced by training rather than architecture — jailbreaks and prompt injection are attempts to invert it. For builders, the system prompt is the highest-leverage, cheapest-to-change part of the stack.