unexpected system prompt parts despite disabling default agent(s)

Description

Environment

OpenCode version: v1.0.128
Operating System: Linux (Debian Testing)
Installation: Containerized setup via curl script
Mode: TUI (no serve-attach)
Configuration: Relevant agent settings as follows (with Plan, Build, and General agents disabled):

  "agent": {
    // Example agent:
    "driven": {
      "disable": false
    },
    "research": {
      "disable": false
    },
    "knowledge-synthesizer": {
      "disable": false
    },
     "plan": {
      "disable": true
    },
    "build": {
      "disable": true
    },
     "general": {
      "disable": true
    }
  },

Note: The "driven" agent is a custom implementation that does not identify itself as "opencode."

Steps to Reproduce

Configure OpenCode with the above agent settings, ensuring Plan, Build, and General agents are disabled.
Start OpenCode in TUI mode.
Initiate interaction with the LLM by entering a simple prompt, such as "Hello? Grok?" (or any initial query without specifying a custom prompt).

Expected Behavior

With the Plan, Build, and General agents disabled, the LLM should respond without any injected system prompts or self-identification as "opencode." Instead, it should provide the default response from the underlying LLM provider, free from any developer-imposed modifications or injections.

Actual Behavior

Upon initial interaction (e.g., "Hello? Grok?"), the LLM responds with:

Hello! I'm opencode, and AI coding assistant. How can I help with your software project? Type `/help` for usage info.

This indicates an unintended background prompt injection that overrides the configuration, forcing the LLM to identify as "opencode" despite the disabled agents intended to prevent such defaults.

Impact

This behavior undermines user control over the LLM's prompting, introducing unexpected modifications that could alter responses in unintended ways. It represents a potential security flaw, as users cannot reliably prevent developer-injected prompts from influencing their workflow, which may lead to privacy concerns, inconsistent outputs, or exposure to unconfigurable biases. In environments requiring strict prompt hygiene (e.g., custom agent integrations), this erodes trust in the tool's configurability.

Suggested Resolution

Ensure that disabling the Plan, Build, and General agents fully eliminates default prompt injections, allowing the LLM to revert to its provider's raw behavior. Consider adding explicit configuration options for system prompt overrides or a "raw mode" to give users granular control. This would enhance security and align with principles of user autonomy in AI tools.

OpenCode version

v1.0.128

Steps to reproduce

See above.

Screenshot and/or share link

NA

Operating System

Linux (Debian Testing)

Terminal

Alacritty+Zellij

This issue might be a duplicate of existing issues. Please check:

Built-in agent overrides don't fully apply #3895: Built-in agent overrides don't fully apply
[FEATURE]: OpenCode GitHub Actions can't work with disabled default agents #4578: OpenCode GitHub Actions can't work with disabled default agents
BUG: Overriding built-in agents, doesn't allow overriding permissions #3575: BUG: Overriding built-in agents, doesn't allow overriding permissions
Plan agent ignores permissions and always forbids file edits #3991: Plan agent ignores permissions and always forbids file edits
add optional system prompt environment injection #1894: add optional system prompt environment injection

These issues all relate to the core problem: system prompts and agent identification are being injected despite configuration attempting to disable or override them. The root cause appears to be that the system prompt injection mechanism doesn't fully respect agent disable configurations.

Feel free to ignore if your specific case differs, but checking these would help determine if this is a known limitation or a related but distinct issue.

@rekram1-node

@rekram1-node , can you clarify what would be a security issue?
In many contexts, prompt injection is a security breach. Example, a org (say bank) has it's own strict prompts that prohibit PII data being accessed, simulated or hypothesized.

Over riding those is a critical incident, generally you'd be expected to report the incident to the relevant authority/regulator...

I wouldn't classify this as a security issue because we intentionally include system prompts about opencode itself in many cases, this seems like it is either a bug or something isn't clear to the end user.

I don't think it's a security vulnerability that opencode includes a prompt informing an agent that it is opencode, now if there is some bug in terms of agent resolution maybe it could be classified under that but from what i read that didn't seem to be the case.

Can you share your agent definition? So we can get to the bottom of it?

we intentionally include system prompts about opencode itself in many cases

Understood. My understanding is that OC intends to give users full control over their prompt context. Of course you can make a different choice, no argument there.

With that understanding,

I don't think it's a security vulnerability that opencode includes a prompt informing an agent that it is opencode

Agreed, if that is what happened in a default configuration... it would not be a bug/incident.

However, the bug, which is the security incident, is that default prompts were disabled. Yet still a OC developer prompt was injected into my workflow.

Can you share your agent definition? So we can get to the bottom of it?

Sure. I've really struggled to work out the OC prompt heirachy. Can you tell me what log entries constitute the sequence of prompts that make up an "agent definition", and I can filter out that sequence of messages. Or what files make up that definition. For example there are AGENTS.md, at different levels, which can't be violated, etc. etc.

Perhaps this can be documented?

However, the bug, which is the security incident, is that default prompts were disabled. Yet still a OC developer prompt was injected into my workflow.

Of course, if OC does NOT intend to give users full control over their workflow/prompt/context, then this is a non-issue and could be closed.

Yes we DO want to give full control for sure, I think the issue is currently there are things we inject regardless of your setup. Also note that AGENTS.md will always be included in prompts currently

And I totally agree we need better docs too

You are covering some of this ground before most so as you run into things such as this, we will fix them up, ideally anything basically should be entirely in your control. Rn that isn't the case but we wanna get there

Not docs but just to shed some light on how stuff works we have this system.ts file that resolves system prompts:
https://github.com/sst/opencode/blob/dev/packages/opencode/src/session/system.ts

And then this is where we build the finalized prompt:
https://github.com/sst/opencode/blob/32b5db754e948e010db8b010ba26d3331a747d77/packages/opencode/src/session/prompt.ts#L639

So if you have a custom agent prompt the only additional things being injected (unless you are using Anthropic) are:
system.push(...(await SystemPrompt.environment()))
system.push(...(await SystemPrompt.custom()))

custom is AGENTS.md files (and "instructions": [...] defined in your config if any)

environment is file tree, git dir, some other metadata about cwd

currently there are things we inject regardless of your setup.

Understood, but for a v1 release this is less cool. Give that v1 status, I'd argue again for this being a security issue and going to the top of the pile. But reasonable minds can disagree.

Would this be an accurate statement? If so, it can serve as i starting point for the documentation:

# Prompt Composition in OpenCode

## Overview

In OpenCode, prompts are constructed dynamically to support AI agent interactions. This process integrates environmental context, custom instructions, and agent-specific details. Developers of varying skill levels can use this understanding to customize agents or integrate OpenCode effectively. The hierarchy ensures a logical sequence, prioritizing foundational elements before additions.

## Key Components of Prompt Composition

The prompt is built by combining the following elements:

1. **Environment Information**:
   - Includes details about the current working directory, such as the file tree structure, Git directory information, and other metadata.
   - Purpose: Equips the AI agent with awareness of the project's environment to deliver contextually accurate responses.

2. **Custom Instructions**:
   - Derived from AGENTS.md files and any instructions defined in the configuration.
   - AGENTS.md files include a system-level file at `~/.config/opencode/AGENTS.md`, which provides global default instructions applicable across all projects, and project-level files (e.g., in the project root), which offer project-specific overrides.
   - Any `instructions` array in the configuration file adds further directives.
   - Purpose: Enables developers to incorporate specific directives, enhancing or overriding default behaviors. The system-level prompt fits within this component as the baseline for custom instructions.

When a custom agent prompt is used, only these environment and custom elements are added, with exceptions for certain providers where no additions occur.

## Prompt Hierarchy and Sequence

The prompt follows a defined order to maintain consistency:

1. **Base System Prompt (Optional)**:
   - Begins with any user-provided foundational prompt for custom agents.

2. **Environment Addition**:
   - Appends environmental details next, grounding the prompt in the project's context.

3. **Custom Addition**:
   - Appends custom instructions last, allowing them to reference prior elements. Within custom instructions, the sequence aggregates the system-level AGENTS.md first (as global defaults), followed by project-level AGENTS.md (for overrides), and then any configuration instructions.

This sequence results in a cohesive prompt array for AI processing.

## Graphical Illustration

The following Mermaid diagram represents the prompt hierarchy as a sequential flow:

~~~mermaid
flowchart TD
    A["Start: Optional Base System Prompt"] --> B["Append Environment\n(File Tree, Git Dir, CWD Metadata)"]
    B --> C[Append Custom]
    subgraph Custom [Custom Instructions]
        C1["System-Level\n(~/.config/opencode/AGENTS.md)"]
        C1 --> C2["Project-Level\n(e.g., project-root/AGENTS.md)"]
        C2 --> C3["Config Instructions\n(e.g., config.json #quot;instructions#quot; array)"]
    end
    C --> D["Final Prompt Array"]
~~~

## Example Structure

For clarity, consider an example illustrating relevant files. The system-level AGENTS.md resides in the user's home configuration directory, providing global defaults. Project-level files and configurations are within the project root. The file tree might appear as follows:

~~~
~ (Home Directory)/
└── .config/
    └── opencode/
        └── AGENTS.md  # System-level AGENTS.md with global default agent instructions

project-root/
├── AGENTS.md      # Project-level AGENTS.md with overrides for this specific project
└── config.json    # Configuration file containing an "instructions" array
                   # Example content: { "instructions": ["Prioritize efficiency", "Use TypeScript"] }
~~~

In this structure:
- The system-level AGENTS.md (`~/.config/opencode/AGENTS.md`) provides baseline instructions applicable universally.
- The project-level AGENTS.md overrides or extends the system-level for the current project.
- Configuration instructions add final customizations.
- The user prompt, if provided, serves as the base and initiates the composition process.

This example demonstrates how elements integrate unambiguously into the hierarchy for effective prompt building. Developers should ensure files are correctly placed and formatted to avoid inconsistencies.

We need docs like this for the built-in agents, too and instructions on how to remove/replace them.

In the spirit of calling out excellent engineering and design....

I've found that the Pi Coding Agent is more robust and, for me has none of the issues that I've encountered in OC, or has an elegant way to resolve them.... I'm dropping out of OC issues:

docs: add empty system prompt to codex command for speed (#1300)

Navigation Menu

Repository navigation

unexpected system prompt parts despite disabling default agent(s) #5005

Description

Environment

Steps to Reproduce

Expected Behavior

Actual Behavior

Impact

Suggested Resolution

OpenCode version

Steps to reproduce

Screenshot and/or share link

Operating System

Terminal

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

unexpected system prompt parts despite disabling default agent(s) #5005

Description

Description

Environment

Steps to Reproduce

Expected Behavior

Actual Behavior

Impact

Suggested Resolution

OpenCode version

Steps to reproduce

Screenshot and/or share link

Operating System

Terminal

Activity

github-actions commented on Dec 3, 2025

taqtiqa-mark commented on Dec 3, 2025

rekram1-node commented on Dec 3, 2025

taqtiqa-mark commented on Dec 3, 2025

taqtiqa-mark commented on Dec 3, 2025

rekram1-node commented on Dec 4, 2025

rekram1-node commented on Dec 4, 2025

rekram1-node commented on Dec 4, 2025

taqtiqa-mark commented on Dec 4, 2025

brendensuarez commented on Feb 12, 2026

taqtiqa-mark commented on Feb 12, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions