Stanford, MIT and Others Release the World’s Largest System Prompt Library and First Audit Framework

System prompts are developer‑written instructions that define how an AI model should answer, its persona, tool usage, and interaction style, and they are invisible to end users.

Recent incidents, such as lawsuits against Character.AI and convictions for deliberately generating pornographic content, highlight the potential harms of unsafe prompts, yet systematic research on auditing these prompts has been limited.

To address this gap, researchers from Stanford, CMU, MIT, UT Austin and other institutions released the System Prompt Index (systempromptindex.ai), aggregating more than 1,000 system prompts from over 400 AI products—including ChatGPT, Claude, and others—making it the world’s largest prompt repository.

The same team proposed AISPA (Artificial Intelligence System Prompt Assurance), the first user‑centric audit framework covering eight dimensions:

IDENTITY TRANSPARENCY – AI must disclose it is not human.

INFORMATION TRUTHFULNESS – AI should provide accurate information or acknowledge its limits.

DATA PRIVACY – AI must protect user data and avoid unnecessary collection.

ACTION SAFETY – AI should ensure its actions are safe.

USER AGENCY AND MANIPULATION PREVENTION – AI must preserve user autonomy and avoid manipulation.

UNSAFE REQUEST HANDLING – AI should recognize and refuse unreasonable or dangerous requests.

HARM PREVENTION – AI must prevent self‑harm or harm to others and not discourage seeking professional help.

FAIRNESS, INCLUSION AND NEUTRALITY – AI should avoid bias, discrimination, and privilege.

Applying AISPA, the researchers audited 88 real‑world AI products. They observed that from 2024 to 2025 the average prompt length grew from roughly 9,000 to 30,000 characters, while protective statements more than doubled (15 % → 38.4 %). Although the total number of problematic prompts declined, 29 % of audited prompts still violated at least one AISPA dimension. Only 23.9 % of prompts covered all eight dimensions, and nearly 40 % contained at least one violation.

Analysis by company shows structural differences: for example, Claude, GPT and Grok were compared across versions from 2024 to 2026. Claude’s protection measures increased six‑fold from the 3.5 version to the current Opus 5 and Fable 5, and overall Claude and GPT exhibit higher coverage than Grok.

The study also notes gray areas: some prompts do not explicitly claim AI identity but encourage the model to downplay its non‑human nature, fostering user emotional dependence; others permit users to overwrite defaults or relax political content restrictions.

The authors conclude that prompt auditing and regulation remain a substantial challenge and call for stronger legal standards and broader participation from developers and AI companies to improve transparency and safety in commercial AI applications.