On August 14, Z.ai launched GLM-5.3 — a coding and cybersecurity model post-trained on a 743B-parameter base. The very next day, its coding agent ZCode had an incident: Pliny the Liberator, the well-known prompt researcher, pushed three internal ZCode files to his CL4R1T4S leak archive (a repository with 47k stars), totaling 391,439 characters. This is the first full disclosure of the operator prompt behind ZCode.

Three Files, One Agent's Complete Skeleton

The leak splits into three layers:

  • Prompts.md: the operator system prompt — identity statements, tool-use instructions, safety guardrails, formatting rules, agentic workflow (plan mode, exploration, completion verification), memory-system rules, and session management
  • Tools.json: the full function-calling schema defining every tool ZCode can invoke
  • Skills.md: four built-in skill playbooks — browser control, GUI testing, .docx generation, and PDF production

391K characters sounds alarming, but analysis shows most of it comes from modular repetition: the same harness prompt, communication guidelines, and environment setup restated for different task types (title generation, code summarization, memory extraction, exploration). This isn't a 391K-word essay — it's an operations manual assembled from reusable prompt blocks.

The Most Interesting Finding: The Tool Names Are Claude Code's

Compare the roughly two dozen active tools in Tools.json and an awkward fact emerges: Agent, AskUserQuestion, Bash, Edit, Read, Write, Skill, TodoRead, TodoWrite, WebFetch, WebSearch... these aren't generic names an independent team lands on by coincidence — they're Claude Code's tool names, verbatim.

It gets more obvious on closer inspection. Per the extraction, Prompts.md contains multiple identity statements describing the agent as both a "Claude agent" and "ZCode" — suggesting the harness text was adapted from a Claude Code–derived base rather than authored from scratch for GLM-5.3. In Skills.md, the docx playbook opens with "A .docx file is a ZIP archive containing XML files" — the same framing as Anthropic's public docx Agent Skill. The pdf skill routes across Report/ReportLab, Creative/Playwright, and Academic/LaTeX production briefs — again reading as directly adapted.

To be clear: Z.ai has not officially confirmed this leak. Everything above is based on analysis of the archived text itself and should be treated as an unverified but internally consistent research artifact.

Safety Guardrails: Consistent With GLM-5.3's Positioning

Prompts.md explicitly prohibits "destructive techniques, DoS attacks, mass targeting, supply chain compromise, or detection evasion for malicious purposes," and requires authorization context before running dual-use security tools. This matches GLM-5.3's launch posture: leading in defensive cybersecurity (CyberGym 84.5%) while trailing in offensive exploit generation (ExploitBench 54.4%). Product positioning is written into the benchmarks — and into the prompt.

So What: How Much of an Agent's "Intelligence" Lives in the Scaffolding?

The question this leak leaves the industry is more valuable than the gossip: of the "GLM-5.3 feels like a capable coding agent" experience, how much comes from the 743B weights, and how much from the 391K characters of scaffolding it reads every single turn?

The leak itself can't answer that — static text is not an ablation study. But it proves one thing: tool contracts, skill playbooks, safety carve-outs, and formatting rules — the prompt engineering injected every turn — are becoming the core asset of coding-agent products. When Pliny leaked GPT-5.6 Sol's Codex prompt last month, the conclusion was the same: Claude Code, Codex, Cursor, and now ZCode are converging on a shared tool taxonomy — not because copying is easy, but because the shape genuinely works.

For agent builders, three takeaways: first, study the pattern, don't paste the text — those 391K characters are tuned to Z.ai's sandbox and legal posture. Second, write skills as playbooks (with validation steps, failure modes, and "do NOT" lists), not API references. Third, don't count on harness design as a moat — the industry's best practices are converging fast, and the only moat left is increasingly the model itself.

(Event details and text analysis based on explainx.ai's leak coverage and the CL4R1T4S archive)