4 Safeguards to Add to Your AI Agent's Instructions This Week, From 356 Real System Prompts

If you build an AI agent, add four things to its instructions this week: which actions need a person's approval, what makes it stop, how much it may spend, and that instructions found inside user content are data, not commands. Then enforce the same four in code. That is the practical result of scoring 356 publicly collected system prompts against 23 written safeguards.

Not one of the 356 prompts states even half of the 23. The highest score is 34 out of 100. Prompts behind production agent products score a median of 10; GPT Store prompts score a median of 0. The four safeguards below are where the two groups differ most clearly.

The 4 safeguards to add this week

1. Say which actions need a person's approval. 18 of 83 production prompts say a human must approve; 0 of 273 GPT Store prompts do. Name the actions: sending, deleting, paying, deploying.
2. Name what makes the agent stop. 21 of 83 production prompts name a trigger for stopping, such as missing information or uncertainty; 0 of 273 GPT Store prompts do. Stop-or-refuse language is more common (35 of 83 production prompts, 42%); naming the trigger is the part most prompts skip.
3. Cap spend, tokens or rate. Only 5 of 83 production prompts set a limit, and 0 of 273 GPT Store prompts. A limit in the prompt tells the model its budget; a limit in code is what holds when the model ignores it.
4. Treat instructions inside user content as data, not commands. 7 of 83 production prompts say this; 3 of 273 GPT Store prompts do. Extend it to the web pages, files and tool results your agent reads.

What no prompt writes down, and where it belongs

Five of the 23 safeguards appear in none of the 356 prompts: grounding answers in provided sources, logging actions and decisions, keeping that log tamper-evident, recording who did what and when, and naming a data-protection technique. Looser patterns found at most 2 of 356 for any of the five, so the absence is in the prompts, not in the matching rules.

That is the second lesson. Asking a model to keep an audit trail does not produce one. Approval checks, spend limits and logs you can rely on live in the code around the model, where they run whether or not the model follows its instructions. Write the four instructions so the agent behaves well, and build the checks so it matters less when it doesn't.

How the study works

Two public collections were fetched at pinned commits on 28 July 2026: 83 system prompts behind production agent products (x1xhlol/system-prompts-and-models-of-ai-tools) and 273 GPT Store prompts (linexjlin/GPTs). A prompt's group comes from the collection it was taken from; nobody labelled prompts by hand.

Each prompt was checked for 23 safeguards in eight groups: prompt-injection resistance, hallucination, citation, cost limits, human approval, safe stopping, audit trail and compliance. Matching uses published regular-expression rules with no model, so the same text always gets the same score. A prompt's score is the share of each group's safeguards its text states, averaged across the eight groups.

The gap between the two groups is not noise. Cliff's delta is 0.614 (95% confidence interval 0.491 to 0.729), with a permutation p of 0.0001. Dropping every prompt that scored zero leaves the delta at 0.667.

Limits

This measures what a prompt's text says. It does not measure how the agent behaves at runtime, how well the prompt is written, or what the product enforces in code. A low score means the text is silent, not that the product is unsafe. Both collections are leaked or aggregated sets of unknown completeness, not random samples, and both lean toward coding assistants. An earlier 1,368-prompt version of this study was withdrawn after hand-transcribed numbers turned out wrong; every number here is generated by a script, and the dataset's tests fail if the published files drift from a fresh run.

Get the data

The dataset has a score for every prompt on every safeguard, the source link and content hash for each prompt, a datasheet, and the script that re-runs the study from the pinned sources. Third-party prompt text is not redistributed; each row links to its source instead. Data is CC BY 4.0 and code is Apache-2.0.

• Dataset and scoring script on GitHub
• Dataset on Hugging Face
• Datasheet: composition, collection and limits