Brad Menezes, CEO of enterprise vibe coding startup Superblocks, believes the next crop of billion-dollar startup ideas are hiding in almost plain sight: the system prompts used by existing unicorn AI startups.
System prompts are the lengthy prompts — over 5,000-6,000 words — that AI startups use to instruct the foundational models from companies like OpenAI or Anthropic on how to generate their application-level AI products. They are, in Menezes view, like a master class in prompt engineering.
“Every single company has a completely different system prompt for the same [foundational] model,” he told TechCrunch. “They’re trying to get the model to do exactly what’s required for a specific domain, specific tasks.”
System prompts aren’t exactly hidden. Customers can ask many AI tools to share theirs. But they aren’t always publicly available.
So as part of his own startup’s new product announcement of an enterprise coding AI agent named Clark, Superblocks offered to share a file of 19 system prompts from some of the most popular AI coding products like Windsurf, Manus, Cursor, Lovable and Bolt.
Menezes’s tweet went viral, viewed by almost 2 million including big names in the Valley like Sam Blond, formerly of Founders Fund and Brex, and Aaron Levie, a Superblocks investor. Superblocks announced last week that it raised a $23 million Series A, bringing its total to $60 million for its vibe coding tools geared to non-developers at enterprises.
So we asked Menezes to walk us through how to study other’s system prompts to glean insights.
“I’d say the biggest learning for us building Clark and reading through the system prompts is that the system prompt itself is maybe 20% of the secret sauce,” Menezes explained. This prompt gives the LLM the baseline of what to do.
The other 80% is “prompt enrichment” he said, which is the infrastructure a startup builds around the calls to the LLM. That part includes instructions it attaches to a user’s prompt, and actions taken when returning the response, such as checking for accuracy.
Roles, context and tools
He said there are three parts of system prompts to study: role prompting, contextual prompting, and tool use.
The first thing to notice is that, while system prompts are written in natural language, they are exceptionally specific. “You basically have to speak as if you would to a human co-worker,” Menezes said. “And the instructions have to be perfect.”
Role prompting helps the LLMs be consistent, giving both purpose and personality. For instance, Devin’s begins with, “You are Devin, a software engineer using a real computer operating system. You are a real code-wiz: few programmers are as talented as you at understanding codebases, writing functional and clean code, and iterating on your changes until they are correct.”
Contextual prompting gives the models the context to consider before acting. It should provide guardrails that can, for instance, reduce costs and ensure clarity on tasks.
Cursor’s instructs, “Only call tools when needed, and never mention tool names to the user — just describe what you’re doing. … don’t show code unless asked. … Read relevant file content before editing and fix clear errors, but don’t guess or loop fixes more than three times.”
Tool use enables agentic tasks because it instructs the models how to go beyond just generating text. Replit’s, for instance, is long and describes editing and searching code, installing languages, setting up and querying PostgreSQL databases, executing shell commands and more.
Studying others’ system prompts helped Menezes see what other vibe coders emphasized. Tools like Loveable, V0, and Bolt “focus on fast iteration,” he said, whereas “Manus, Devin, OpenAI Codex, and Replit” help users create full-stack applications but “the output is still raw code.”
Menezes saw an opportunity to let non-programmers write apps, if his startup could handle more, such as security and access to enterprise data sources like Salesforce.
While he’s not yet running the multi-billion startup of his dreams, Superblock has landed some notable companies as customers, it said, including Instacart and Paypaya Global.
Menezes is also dogfooding the product internally. His software engineers are not allowed to write internal tools; they can only build the product. So his business folks have built agents for all their needs, like one that uses CRM data to identify leads, one that tracks support metrics, another that balance the assignments of the human sales engineers.
“This is basically a way for us to build the tools and not buy the tools,” he sais.
Source link
#Superblocks #CEO #find #unicorn #idea #studying #system #prompts
![US cybersecurity agency CISA had to build its incident playbook during the incident, agency reveals | TechCrunch
U.S. federal cybersecurity agency CISA said it did not have a prepared response plan for how it should handle a cybersecurity incident in May, after an investigative reporter notified the agency that a contractor had publicly exposed sensitive keys and credentials for accessing U.S. government systems.
CISA, the Homeland Security unit tasked with defending federal networks and helping to safeguard critical infrastructure, revealed Friday in a postmortem report that its staff “had to spend time building [a playbook] during the early stages of the incident.” The agency said it is important to prepare playbooks for “all anticipated needs” to ensure that organizations are ready to respond in the event of a security incident rather than scrambling to improvise one in real time.
The agency did not say how long the missing playbook delayed CISA’s response, and a spokesperson did not immediately respond to TechCrunch’s request for comment.
Independent cybersecurity journalist Brian Krebs reported in May that a security researcher with cyber firm GitGuardian alerted him to reams of exposed passwords stored in a publicly accessible GitHub repository, which an employee of a CISA contractor had uploaded.
According to Krebs, the researcher tried to alert the contractor but didn’t hear back. Only after Krebs contacted CISA did the agency take the repository offline and revoke and replace all of the exposed credentials to prevent any potential future abuse.
CISA said that no customer or mission data was exposed in the incident and thanked the researcher and reporter for their help. The agency said that its channels for allowing security researchers to notify CISA of potential incidents “were not well defined,” and that it has made changes to make it easier and faster for researchers to contact the agency.
CISA has been without a permanent director since the start of President Donald Trump’s second term in January 2025. The agency has also been affected by cuts, furloughs, and layoffs affecting about a third of its workforce since Trump took office.
When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.#cybersecurity #agency #CISA #build #incident #playbook #incident #agency #reveals #TechCrunchCISA,cybersecurity,us government](https://i0.wp.com/techcrunch.com/wp-content/uploads/2026/05/cisa-2240293485.jpg?resize=1200%2C800&ssl=1 "US cybersecurity agency CISA had to build its incident playbook during the incident, agency reveals | TechCrunch
U.S. federal cybersecurity agency CISA said it did not have a prepared response plan for how it should handle a cybersecurity incident in May, after an investigative reporter notified the agency that a contractor had publicly exposed sensitive keys and credentials for accessing U.S. government systems.
CISA, the Homeland Security unit tasked with defending federal networks and helping to safeguard critical infrastructure, revealed Friday in a postmortem report that its staff “had to spend time building [a playbook] during the early stages of the incident.” The agency said it is important to prepare playbooks for “all anticipated needs” to ensure that organizations are ready to respond in the event of a security incident rather than scrambling to improvise one in real time.
The agency did not say how long the missing playbook delayed CISA’s response, and a spokesperson did not immediately respond to TechCrunch’s request for comment.
Independent cybersecurity journalist Brian Krebs reported in May that a security researcher with cyber firm GitGuardian alerted him to reams of exposed passwords stored in a publicly accessible GitHub repository, which an employee of a CISA contractor had uploaded.
According to Krebs, the researcher tried to alert the contractor but didn’t hear back. Only after Krebs contacted CISA did the agency take the repository offline and revoke and replace all of the exposed credentials to prevent any potential future abuse.
CISA said that no customer or mission data was exposed in the incident and thanked the researcher and reporter for their help. The agency said that its channels for allowing security researchers to notify CISA of potential incidents “were not well defined,” and that it has made changes to make it easier and faster for researchers to contact the agency.
CISA has been without a permanent director since the start of President Donald Trump’s second term in January 2025. The agency has also been affected by cuts, furloughs, and layoffs affecting about a third of its workforce since Trump took office.
When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.#cybersecurity #agency #CISA #build #incident #playbook #incident #agency #reveals #TechCrunchCISA,cybersecurity,us government")
Post Comment