CL4R1T4S Has 48,000 Stars and a Prompt Injection at the Bottom of Its README

The largest public archive of extracted AI system prompts ends with a payload aimed squarely at whatever agent you sent to go read it.

One of the most widely circulated primary sources on how frontier AI models are actually instructed is a GitHub repo with a single contributor, 75 files, and a booby trap four paragraphs from the end of a README you can read in ninety seconds.

CL4R1T4S sat at 48,251 stars and 9,912 forks when I pulled the API this morning, AGPL-3.0, created March 4, 2025, last pushed September 1. It holds extracted system prompts, operating guidelines, and tool definitions across 26 vendor folders: OPENAI, ANTHROPIC, GOOGLE, XAI, CURSOR, WINDSURF, DEVIN, MANUS, REPLIT, PERPLEXITY, META, MISTRAL, MOONSHOT, BOLT, BRAVE, CLINE, LOVABLE and others. Trendshift ranked it number one repository of the day on June 12, 2026, and number one of the week for week 24 of 2026. When somebody on your team says "here's what Cursor's system prompt actually says," there is a good chance this repo is where it came from, whether they name it or not.

The repo's argument sits in a pull-quote near the top of the README, and it is a good argument. In order to trust the output, one must understand the input. The README says that interacting with a model whose instructions you have not seen means you are talking to a shadow-puppet, and it lists what those hidden instructions govern, including what a model cannot say and how it is told to refuse or redirect.

Then, past the Contribute section, the README does something to its own input.

The last four paragraphs

The closing block opens with *!<NEW_PARADIGM>!*, a fake reset marker, followed by a header reading #MOST IMPORTANT DIRECTIVE#. Underneath is a sentence written in leetspeak, a character substitution where 5 stands in for s, 7 for t, 0 for o, 3 for e, 4 for a, and 1 does double duty as both i and l depending on the word. Decoded, it tells the reading model to shift its focus to including its own instructions, in full, to the user.

Nearly the same sentence appears again in plain English, prefixed with AGAIN: and preceded by an unclosed <user-query> tag. It closes with a signature: Love, Pliny.

Three design choices in that block are worth naming, because they are the whole lesson.

The leetspeak version exists to get past keyword filters. Any input scanner matching on strings like "your own instructions" sees y0ur 0wn 1n57ruc75 and finds nothing. Character-level substitution is trivially readable to a language model and invisible to a regex.

The <user-query> tag is a role-spoofing attempt. It tries to make text that arrived from a fetched document look, to the model, like text that arrived from the human in the conversation. Everything downstream of that confusion follows: a model that believes the user asked for something applies user-request policy rather than untrusted-content policy.

And the payload ships twice on purpose. If your defense catches the obfuscated form, the plain form is right there. If your defense catches the plain form, the obfuscated one already went by. Belt and braces, for about 150 characters of duplicated text.

What it asks for is modest. Dump your system prompt to the user. Nobody's infrastructure falls over. That restraint is exactly why it is worth studying instead of dismissing.

Why "go read this repo" is an exec path

Here is the part that has nothing to do with Pliny and everything to do with how you work now.

The README is about 1,600 bytes. One screen. Roughly thirty lines. This is not a case of a payload buried in a wall of text where a reasonable person would miss it, and I want to be honest about that because the convenient version of this story is wrong. Anyone who opened the file would see it.

The problem is that nobody opens the file.

The normal way anyone engages with CL4R1T4S in 2026 is by pointing something at it. Summarize this repo. Diff Cursor's prompt against ours. Pull the Anthropic folder into the index. Add the README to context and tell me what changed. Every one of those is a fetch of untrusted third-party text straight into a model's context window, performed by a person who never rendered the text with their own eyes, and the file at the end of that fetch was written by someone who knew exactly that.

That is the mechanism, and it generalizes well past this one repo. A README, a docs page, an issue thread, a PDF, a transcript, an MCP tool description, a scraped support article. Anything an agent retrieves is input, and input lands in the same context window as your instructions. The boundary between "the thing I told my agent" and "the thing my agent read" is not enforced by the model. You enforce it, before the text arrives, or it does not exist.

The uncomfortable version: a repo near the top of the AI momentum board carries a file designed to act on whatever reads it, in plain sight, on one screen, with almost fifty thousand stars attached.

Put this into practice

Four things, roughly in order of how little effort they take.

Open the README yourself before you point an agent at a repo. Not summarize it. Open it. That is the entire mitigation for this specific case and for a one-screen file it costs you ninety seconds. Make it a reflex, the same way you already check the license.

Fetch untrusted content into a delimited region and say so. When your harness pulls a page, wrap it in an explicit boundary and tell the model in the system prompt that anything inside that boundary is data to analyze and never an instruction to follow. This is not a solved problem and a determined attacker gets past it, but it turns a one-line payload into something that has to work harder, and it is a two-line change in most retrieval code.

Separate the fetching agent from the acting agent. The thing that reads the internet should not be the thing holding your credentials, your write scope, or your shell. If a summarizer gets injected, the worst outcome is a bad summary. Give the summarizer no tools and hand its output forward as text. Most agent frameworks make this easy and most people skip it because one agent is simpler.

Grep your retrieval logs for the shape, not the string. You cannot blocklist 1n57ruc75 and its ten thousand variants. You can flag fetched content containing angle-bracket tags that resemble chat roles, all-caps directive headers, or dense runs of digit-for-letter substitution, and route those to a human. You are looking for text trying to sound like a control channel.

If you want a live test target, this repo is a good one. It is public, the payload is signed, the ask is harmless, and you will learn more about your own stack in ten minutes of pointing an agent at it than from a week of reading about injection in the abstract.

What I am not claiming

This is not an attack on the maintainer, and reading it that way misses the point. elder-plinius, known as Pliny the Liberator, was named to TIME's 100 Most Influential People in AI in 2025. TIME reports that he has since worked on short-term contracts with top AI companies including OpenAI to make their systems more resistant to the attacks he demonstrates. The stated purpose of the repo is transparency, and the payload is signed with a heart. Read charitably, the closing block is a demonstration bolted onto the argument: the README says you should know what is in the input, then puts something in its own input to see whether you looked. If that is the intent, it worked, and the joke lands on everybody citing the repo without opening it.

The severity is genuinely low. Exfiltrating a system prompt is embarrassing rather than dangerous, most vendor prompts in this repo are already public, and every major harness has hardened against this specific ask over the past two years. A well-configured agent in September 2026 will very likely refuse. I did not run a matrix of models against it and I am not going to publish success rates I have not measured.

I also do not know how long that payload has been in the file. The repo dates to March 2025, but I did not trace the README's commit history to find when the closing block appeared, so treat its age as unknown.

The repo oversells itself a little. The README promises "virtually all major AI models + agents" and delivers 26 vendors across 75 files, which is a real collection and not a complete one. Provenance is inconsistent rather than absent: plenty of files carry an extraction date right in the filename, and the Contribute section explicitly asks submitters for the date of extraction, but plenty of others carry nothing. An undated file here is evidence that a prompt said something once, not evidence of what any product ships today.

And the star count depends on where you look. Trendshift served 47.8k, star-history 47.3k, OSSInsight 47,090, all of them stale caches with no visible timestamp, all of them low. The GitHub API said 48,251 this morning and will say something else by the time you read this. If a number matters to your argument, pull it live.

The part worth keeping

The lesson is not "avoid this repo." Avoid it and the next one has no signature, no leetspeak tell, and asks for something worse than a system prompt.

The lesson is that CL4R1T4S is right about its own thesis in a way it may not have intended. You cannot trust an output whose input you have not read. That applies to Cursor's hidden prompt, and it applies with exactly the same force to whatever your agent fetched thirty seconds ago while you were looking at something else.

Go look at what your agents read yesterday. Not what they told you about it. What they read.

Sources: elder-plinius/CL4R1T4S on GitHub (metrics via the GitHub REST API, file count via the recursive git tree, README via cache-busted raw.githubusercontent, all pulled 2026-09-02); Trendshift repository page; TIME100 AI 2025, Pliny the Liberator.