04 · AI Fundamentals Lab
How much of a chatbot’s personality is just a paragraph someone wrote?
A system prompt is a block of standing instructions pasted in front of every conversation, before the user ever types. Ask the same question with different instructions in front of it and watch the answer change shape — then notice the one thing it never changes.
Same question, different instructions
Pick a question a student might ask a security assistant. Then pick the standing instructions sitting invisibly above it. The question text never changes — only the instructions do.
The answer
Written example, composed for this lesson to show the effect. Nothing on this page contacts a model.
Write your own
Write the standing instructions for a security helpdesk assistant. As you type, the page estimates what those instructions cost and does a rough check for the five things a useful system prompt usually contains.
Rough check
This is a keyword check, not a grader. It looks for words that usually signal each element. It can be fooled both ways — a good prompt may score badly, and a nonsense one may score well. Read the reasons, not the ticks.
Why this is not a security control
The most important panel in this module. Read it twice.
A system prompt and a user message end up in the same place: one long stream of text handed to the model. There is no wall between them. The model was trained to follow instructions in that text, and it has no reliable way to tell whose instructions they were.
So an instruction in a system prompt is a strong preference, not an enforced rule. It can be argued with, out-reasoned, buried under conflicting text, or simply ignored on an off day.
Two ways it goes wrong
Written examples, composed for this lesson from the shape of publicly reported incidents. Not live model output, and not a recipe — the point is the consequence.
What to do instead
A system prompt changes how a model answers, not what it knows — and it is instructions, not a security boundary.
If an answer must be short, structured or cautious, the system prompt is the right tool. If something must never happen, put that rule somewhere the model cannot read and cannot talk its way past.
My observations
Kept in this browser tab only, for this session.