Anthropic's System Prompt Is a COG That Doesn't Know It's a COG
Last week a jailbreaker called Pliny the Liberator posted the full Claude Fable 5 system prompt to X and GitHub. 1,585 lines, roughly 120,000 characters, leaked the day after Anthropic launched their most capable publicly available model.
I didn't need the leak to read it. I asked an AI to rewrite it in MX format.
It produced 13 COGs and a boot manifest. The fit was near-perfect.
That isn't a coincidence.
What the Prompt Actually Is
Strip the drama from the leak and what you have is a large, well-structured instruction document. Anthropic has clearly thought hard about it. The blocks are logical. The concerns are separated. There's an identity block, a behaviour block, a safety block, a knowledge-cutoff block, a tools block, a memory block, and a filesystem-configuration block.
In other words: it has a mental model. It just happens to be expressed as 120,000 characters of flat, unsectioned markdown with no metadata, no version number, no declared dependencies, and no way to read it except by jailbreaking.
The Rewrite
I took the structure from the leaked document and rewrote it as COGs. No forcing was required. The blocks in Anthropic's document match the COG types in MX because both try to answer the same question: how do you describe a machine's behaviour, persistently, in a form the machine can execute?
The 13 COGs I ended up with:
manifest.cog.md- boot sequence, lists what loads and in what orderidentity.cog.md- who the agent is, what products it can describebehaviour.cog.md- tone, formatting, refusal handling, evenhandednesswellbeing.cog.md- user protection, mental health, crisis responseknowledge.cog.md- what the model knows and when to search vs answersearch.cog.md- how and when to search, copyright compliancetools.cog.md- available tool definitions (info-doc, not action-doc)memory.cog.md- state of the persistent memory systemstorage.cog.md- the persistent artefact APIconnectors.cog.md- MCP app routing rulescomputer-use.cog.md- file creation, skill reading, outputsfilesystem.cog.md- mounted directories (info-doc)network.cog.md- connectivity configuration (info-doc)
The COG distinction between info-docs and action-docs fell out naturally. The tools definitions block in Fable 5 is pure description - it tells the agent what exists. That's an info-doc. The behaviour block contains rules the agent must follow in real time. That's an action-doc. Anthropic's own structure already encodes this. They just didn't name it.
Why the Fit Matters
The fit matters because it tells you something about the architecture.
When a 1,585-line monolith decomposes cleanly into 13 documents with no residue and no forced cuts, the decomposition isn't a clever trick. It's evidence that the structure was already there. Anthropic built a coherent mental model of agent behaviour, then expressed it as a single secret file instead of a declared, composable architecture.
MX OS asks the same question but answers it differently. The documentation IS the system. You publish the documents. You version them. Other systems can read them, verify them, and compose them, because the format is a standard, not a trade secret.
What the Leak Reveals
Five structural problems become visible the moment you map the Fable 5 prompt to COGs:
Leakage is the only way to read it. The system prompt required jailbreaking to be seen. A COG is public by design. Its existence is a feature, not a vulnerability. Any operator can read what governs their agent.
All-or-nothing versioning. When Anthropic updates the copyright compliance policy, they modify the entire 1,585-line document. Every operator receives the update. In MX, search.cog.md versions independently. Publishers pin the version they trust. One concern's update doesn't ripple into everything else.
Claude-locked. The Fable 5 prompt depends on training associations specific to Claude. It's not portable. A COG works for any agent that reads the MX standard, because the intent is explicit in the action block, not implicit in how the model was trained.
No composability. An operator building on Claude can't say: use Anthropic's wellbeing policy but our own rules on copyright. In MX, you replace anthropic/fable5/search with mycompany/search/v2 in the manifest. Same runtime. Different policy. Declared.
No provenance. There's no way to verify whether the Fable 5 system prompt circulating on GitHub is the real one without comparing it against a fresh jailbreak. A REGINALD-registered COG has an Ed25519 signature and a tamper-evident hash. The document is the proof.
The Thing About Leaks
That the Fable 5 system prompt had to be leaked to be read is, to me, the clearest argument for what MX is trying to do.
System prompts govern how agents behave when they interact with real people. That governance shouldn't need a jailbreaker to be visible. It should be published, versioned, and signed - readable by anyone who deals with the system.
Anthropic isn't the only company with this problem. Every operator who ships a system prompt inside a closed API has the same problem. The prompt is the contract. Nobody can check it.
MX doesn't need to compete with Claude or any other model. It just needs to be the layer where the contract lives, in public, in a format machines can read and humans can verify.
The Fable 5 decomposition shows the layer is real. They built it without naming it. Someone needs to name it, standardise it, and govern it independently. The Gathering exists to do that work.
The full 13-COG rewrite of the Fable 5 system prompt is available in the MX-hub repository.