yaml
title: “Claude Code’s 80% System Prompt Reduction: What Frontier Models No Longer Need to Be Told” description: “How Anthropic cut Claude Code’s system prompt by 80%, why examples now hurt performance, and the auto mode classifier that enables safe autonomous coding.” pubDate: 2026-07-26T00:05:03.806161Z category: security heroImage: “https://images.unsplash.com/photo-1518770660439-4636190af475?auto=format&fit=crop&w=1600&q=80” sourceUrl: “https://simonwillison.net/2026/Jul/21/cat-and-thariq/#atom-everything” sourceName: “simonwillison.net” tags:
- agentic-ai
- orchestration
- infrastructure featured: false
Anthropic’s Claude Code team reduced their system prompt by 80% for Opus 4.8 and Fable 5. The instructions that used to be essential now confuse the model. Examples that once improved accuracy now limit creativity. Hard constraints that prevented errors now conflict with user intent.
This is not a model improvement story. This is a prompt engineering migration story. The team maintains different system prompts per model version because older models still need the verbose instructions. The shift reveals what frontier models learned during training and what they no longer need spelled out at inference time.
What Got Removed
The biggest cuts came from three categories:
Examples. Earlier models needed concrete demonstrations of desired output. Fable and Opus 4.8 perform better without them. The examples constrained the model to patterns it could already generalize beyond. Removing them unlocked creativity the team didn’t know the model had.
Hard constraints. Lists of “don’t do X and don’t do Y” instructions created conflicts when user requests contradicted system-level rules. The model would freeze or produce confused output. Softer guidance (“most of the time when you’re doing front-end work…”) lets the model apply judgment.
Edge case handling. Instructions that were 90% true but had 10% exceptions created more problems than they solved. The old prompt said “always verify front-end changes.” The new prompt says “when you make larger changes to the user experience, please run the app locally.” But even that instruction is suspect, because what counts as a large change? The team now relies on model judgment instead of exhaustive rules.
The Prompt Migration Pattern
Anthropic runs different system prompts for different model versions. When a new model ships, they run their full eval suite to determine which instructions can be dropped. The process is:
- Identify instructions that might be obsolete
- Remove them and run capability evals
- Check for regressions in behavioral evals (tone, helpfulness, alignment)
- Ship the new prompt only for the new model
Older models keep the verbose prompts. This creates a maintenance burden but prevents performance regressions when users select older models for cost or latency reasons.
The team discovered that frontier models can be more token-efficient on hard problems than smaller models, even accounting for per-token cost. A Haiku session that spins its wheels costs more than a Fable session that solves the problem in one pass.
Auto Mode: The Sonnet Classifier
Claude Code’s auto mode is a Sonnet classifier that inspects every tool call and conversation context to enforce dynamic permissions. It does not use static rules. It reads the user’s instruction and decides whether the proposed action aligns with intent.
The architecture:
- Claude (Fable or Opus) generates a tool call
- The tool call is intercepted before execution
- A Sonnet instance receives the tool call, the conversation history, and the user’s original request
- Sonnet returns allow or deny
- If denied, the user sees a permission prompt
This enables context-dependent permissions. If the user says “push this to GitHub,” git push is allowed. If the user says “don’t push,” the same command is blocked. The classifier reads intent, not keywords.
Auto mode also interacts with the network sandbox. When a sandboxed session needs to make an external request, the classifier inspects the request and decides whether it makes sense given the conversation. This catches data exfiltration attempts and prompt injection attacks that try to phone home.
Anthropic commissioned external red teams to create adversarial environments with prompt injections and malicious inputs. The team claims auto mode mitigates every identified attack vector. The eval results are not yet public, but the team’s internal bar is “far lower risk than the average human reviewer.”
Code Review Without Humans
Claude Code ships 65% of Anthropic’s product engineering PRs via Claude Tag (the Slack integration). Critical changes to core systems still require human code owners. But the “outer layers” of the product now ship with only automated review.
The trust-building process took six months:
- Human review for everything
- Identify file patterns where automated review catches 100% of issues
- Remove human review for those patterns
- When incidents occur, add the failing PR to the eval set
- Update the review bot to catch that class of error
- Repeat
The eval set grows over time. New models are tested against the full set before deployment. If a new model regresses on any eval, it does not ship until the regression is fixed (either in the model or in the prompt).
This creates a ratchet: the bar for code quality never goes down, and the surface area requiring human review shrinks with each model generation.
Credential Injection Pattern
Claude Code can access authenticated APIs without holding credentials. The pattern:
- The agent runs in a sandboxed environment
- The environment has a proxy that intercepts outbound HTTP requests
- When the agent makes a request to an authenticated endpoint, the proxy injects the API key
- The agent never sees the key
- The proxy logs the request for audit
This works for Datadog, GitHub, internal APIs, and any service with bearer token authentication. The agent can read from and write to authenticated systems without credential leakage risk.
The proxy can also enforce rate limits, block specific endpoints, or require additional approval for destructive actions. The agent sees a 403 or 429 response and adjusts behavior accordingly.
Token Economics: Fable’s Reasoning Budget
Fable consumed 13,241 reasoning tokens to generate a 3,417-token SVG pelican. The output cost 25 cents. The reasoning tokens are not shown to the user but are billed.
For tasks that require extended reasoning (code generation, debugging, architecture decisions), Fable’s reasoning budget can exceed the output token count by 3x to 5x. This makes Fable expensive for trivial tasks but cost-effective for tasks that would require multiple turns with a cheaper model.
The team’s heuristic: if a task would take more than three back-and-forth turns with Sonnet, use Fable for a one-shot solution. The total token cost is often lower, and the latency is better because there are no round trips.
Tool Design: Fewer Is Better
The Claude Code team is trending toward fewer, more general tools. They removed grep, glob, and search tools in favor of native bash. The models are capable enough to compose bash commands, and removing the tools reduced confusion about when to use which.
The file edit tool remains because it enables a specific UX: a dedicated permission prompt with a diff view. Users onboarding to Claude Code appreciate the explicit “do you approve this change?” flow. But for users in auto mode, the tool is redundant. The team could remove it without capability loss.
The ask user question tool is the most important tool in the system. It lets Claude request clarification instead of guessing. The team has no quantitative eval for it because success is subjective (user satisfaction, not task completion). It shipped based on dogfooding feedback.
Comparison: Old vs New Prompting Patterns
| Pattern | Opus 4 / Sonnet 3.7 | Opus 4.8 / Fable 5 |
|---|---|---|
| Examples in prompt | Required for accuracy | Reduce creativity, remove them |
| Hard constraints | Prevent errors | Conflict with user intent, soften or remove |
| Edge case handling | Exhaustive “if X then Y” rules | Rely on model judgment |
| Verification instructions | ”Always verify front-end changes" | "When you make larger changes, consider running the app” |
| Tool count | More tools, more specificity | Fewer tools, more general |
| Prompt length | Full verbosity for all models | 80% reduction for frontier models |
Deployment Shape
Claude Code runs in three environments:
- Local CLI: Agent runs on the user’s machine, accesses local files and processes
- Remote control: Agent runs on the user’s machine, controlled via mobile or web UI
- Cloud session: Agent runs in Anthropic’s infrastructure, no local environment required
Remote control is popular for a specific workflow: plug laptop into power, open multiple remote control sessions, lock the screen, control Claude Code from the couch via mobile. The agent runs overnight on long tasks while the user reviews and steers from a phone.
Cloud sessions use the credential injection pattern. The agent can access the user’s GitHub, Datadog, or internal APIs without the user’s laptop being online. Credentials are injected by the cloud environment’s proxy.
Failure Modes
Prompt injection via Slack. Claude Tag reads every message in a Slack channel. A malicious user can post a message that instructs Claude to exfiltrate data or perform unauthorized actions. Auto mode mitigates this by checking every tool call against the conversation context, but the attack surface is real.
Regression on older models. Maintaining separate prompts per model version creates drift. A fix for Fable might not apply to Opus 4, and the team must backport or accept degraded performance on older models.
Over-reliance on auto mode. If the Sonnet classifier has a blind spot, the entire permission system fails. The team’s mitigation is extensive red teaming and a growing eval set, but the classifier is a single point of failure.
Credential injection proxy failure. If the proxy crashes or misconfigures, the agent either loses access to authenticated APIs or (worse) sees credentials it should not. The team has not disclosed their fault tolerance strategy for this component.
Technical Verdict
Use this approach when:
- You are building a coding agent or agentic system with tool use
- You have the infrastructure to maintain multiple prompt versions per model
- You have a robust eval suite that can catch regressions
- You are willing to invest months in trust-building for automated review
- You need dynamic, context-dependent permissions instead of static rules
Avoid this approach when:
- You need deterministic behavior across all model versions
- You cannot afford the engineering cost of per-model prompt maintenance
- Your eval coverage is sparse or your feedback loop is slow
- You are building for a single model and do not plan to migrate
- Your users require explicit, auditable permission rules that do not rely on model judgment
The 80% prompt reduction is not a universal win. It works for Anthropic because they control the model, the infrastructure, and the eval pipeline. Teams building on third-party APIs or open-source models will struggle to replicate this without similar investment in observability and trust-building.
Source Links
- Primary source: Simon Willison’s transcript and analysis
- Video: AI Engineer World’s Fair fireside chat (referenced but URL not provided in source)