The ZCode Prompt Leak for Marketers: What 391,439 Characters of Internal Prompts Reveals About Your Stack

On the morning of August 15, 2026, a researcher who goes by Pliny the Liberator pushed three files to his CL4R1T4S leak archive — Prompts.md, Tools.json, and Skills.md. Together they ran 391,439 characters. That was the full operator prompt, the entire tool-calling schema, and four built-in skill playbooks for ZCode, the coding-agent harness that Z.ai ships with its newly-released GLM-5.3 model. The character count was the headline. The interesting part was inside.

If you don't work in agent infrastructure, you can be forgiven for skimming past this one. It looked like a security story — a Chinese lab's secrets exposed, an AI jailbreaker at it again, the usual late-summer drama. But here's the thing: this leak isn't really about Z.ai, and it isn't really about Pliny. It's about every marketer who has spent the last two years wiring AI agents into their stack. Because what the 391K characters prove is uncomfortable: the scaffolding around your AI agent is more portable than the model underneath it. The tool names are someone else's tool names. The skill format is someone else's skill format. The marketing job you think is locked to one vendor is, structurally, two clicks away from running on any of four. That's not a leak story — that's a stack-portability story dressed up as one.

What actually got disclosed

The August 15 leak broke into three files, and each tells you something marketers should care about even if you never write code:

Prompts.md is the operator system prompt — identity statements, tool-use instructions, safety guardrails, formatting rules, the agentic workflow (plan mode, exploration, completion verification), memory rules, and session management. It's the manual the model reads every single turn.

Tools.json is the function-calling schema — every tool the agent can invoke, with names and parameters. The interesting finding here, flagged by both explainx.ai and aimodeling.com's analysis of the extracted text: the tool names — Agent, AskUserQuestion, Bash, Edit, Read, Write, Skill, TodoRead, TodoWrite, WebFetch, WebSearch — are Claude Code's tool names, verbatim. They're not generic names an independent team lands on by coincidence. The Prompts.md identity statements describe the agent as both a "Claude agent" and "ZCode" in the same text — suggesting the harness was adapted from a Claude Code–derived base rather than authored independently.

Skills.md is the four built-in skill playbooks — browser control, GUI testing, .docx generation, and PDF production. Each is structured as a procedural playbook with routing logic, validation steps, and explicit "do NOT" lists, not just an API reference. The .docx skill opens with "A .docx file is a ZIP archive containing XML files" — the same framing Anthropic uses in its public Agent Skills.

None of this has been officially confirmed by Z.ai. The archive is an unverified research artifact. But the structure is internally consistent, and the conclusion it pushes is the same conclusion every prior leak in this series has pushed — Pliny's GPT-5.6 Sol Codex prompt, his Claude Fable 5 extraction in June: tool contracts, skill playbooks, safety carve-outs, and formatting rules — the prompt engineering injected every turn — are becoming the core asset of agent products. The model is increasingly interchangeable. The scaffolding is the moat. Except the scaffolding is also the part that gets leaked, forked, and converged on by every lab within two release cycles.

That's the practitioner's hook. What does it actually change in how you run your marketing stack?

Three shifts the leak triggers in my stack

1. The closed-model "moat" just got thinner. Two years ago I would've told you that the difference between Claude and GPT-5.6 Sol on marketing work was the deciding factor in any stack decision. After this leak, I'm less sure. The ZCode harness sitting on top of GLM-5.3 is reading instructions and tool contracts that are functionally identical to the ones Claude Code reads. The behaviors people attribute to "Claude's voice" or "Sol's reasoning style" are increasingly behaviors encoded in the harness, not the weights. That's why my OpenRouter rotation now has three models in it instead of one — and why the bill dropped from $1,840 to $890 a quarter without my outputs getting worse. When scaffolding is portable, the model underneath becomes more of a cost/perf dial than a brand identity.

2. Skill portability just became a budget line. My local OpenClaw setup runs 6 marketing jobs every day on a $12/month VPS — competitor monitoring, daily SEO digest, lead enrichment, Reddit triage, content repurposing, weekly newsletter curation. Every Skill I wrote is a folder with a SKILL.md and a small Python script. After this leak, I'm more confident that the same Skill folder will run on Lindy, ChatGPT Work, ZCode, Claude Code, or whatever the next agent harness is — with minimal rewriting. That means the per-job infrastructure cost keeps compressing. The Skills I built in March are still useful in September, and they'll be useful next March when the next vendor ships. Skill portability is the under-discussed reason your AI tooling budget should be treated as a depreciating asset with an 18-month half-life, not a subscription.

3. Data hygiene for marketer-PII just got more urgent. The ZCode leak didn't expose customer data — it exposed prompts. But every "leaked prompt" in this series is a reminder that the same tools you're routing customer emails and CRM records through are also being shipped to your vendor's CI logs, internal review boards, and now leak archives. The leak doesn't make PII (personally identifiable information) exposure more likely on any individual day; it makes the aggregate exposure over the lifetime of your stack higher than the per-request risk model would suggest. The operational move: route customer-PII jobs — anything that touches email addresses, phone numbers, billing data — through either a private deployment (Ollama + a self-hosted model, an OpenClaw Skill that strips identifiers before calling the API, or a ChatGPT Work enterprise tier with SOC 2 and zero-retention) or a documented vendor with a data-residency contract you can read in one sitting. The default API tier is no longer a defensible default for regulated work, and every leak in this series moves it further out of bounds.

Two watch-items for the next 30 days

Licensing clarity. GLM-5.3's open weights shipped August 28 under a custom license — not MIT, the way GLM-5.2 was. The extra condition targets model-hosting companies earning more than $10 billion a year (they need a Z.ai security review). For most marketers this is fine; for anyone running an agency or mid-size SaaS, the license text matters and the read time is worth the 45 minutes. Watch for: any derivative-fork license drift (Mistral-, Llama-, or Qwen-style rewrites of leaked skill files) and any vendor response that frames skill-format portability as a competitive issue rather than a feature. The former creates risk; the latter would mean a vendor is trying to lock down something that was never really lockable.

Vendor response. Z.ai has not officially commented on the leak as of this writing. The two likely responses — a takedown request to GitHub (CL4R1T4S is a 47k-star public repo) or a quiet hardening of internal prompt-distribution hygiene — both tell you something. A takedown tells you the lab treats the harness as proprietary IP (which the leak suggests it isn't, structurally). Quiet hardening tells you the lab is treating this as a one-off and moving on. Watch for the response form, not the speed. The interesting move would be Z.ai publishing a "here's what we learned and what changes" note, which would signal they understand the convergence is the story — and that's the only response that would actually help marketers.

The closing reframe

A leak of internal prompts used to be a story about a vendor's embarrassment. After this summer — Pliny's GPT-5.6 Sol Codex prompt in July, the Claude Fable 5 extraction in June, and now ZCode in August — it's a story about your stack being more portable than you thought. Every one of these leaks is the same finding in different fonts: tool contracts look the same, skill playbooks look the same, identity statements look the same, and the differences you experience as "Claude voice" or "Sol reasoning" are a thin layer of system prompt on top of an increasingly common scaffolding. That's good news for marketers who plan for portability. It is uncomfortable news for vendors who tried to sell you the model as the product.

The practitioner move is the same one I'd been making anyway: don't tie your workflow to one model. Don't tie your Skill to one harness. Don't tie your customer data to one vendor's default retention policy. Treat every leak the same way — as a free audit of what the industry actually agrees on. Then build on top of the agreement, not the difference. The leak isn't the news. The convergence is.