KIMI_NOW timestamp splits the system prompt into two injectable payload blocks

[blueberrycongee]

KIMI_NOW timestamp splits the system prompt into two injectable payload blocks

Summary

The system prompt template inserts a dynamic KIMI_NOW timestamp (plus a self-referential explanation) at line 89, roughly in the middle of the message. This timestamp is not a static instruction; it is dynamic content that changes every turn. Its placement has two negative effects:

1. It physically splits the core system instructions into two large blocks of mutable context.
2. It makes the entire system message non-cacheable, because the timestamp changes every request.

This is a design/structural issue, not just a wording bug.

Observed structure

Based on local inspection of the system prompt template:

Region	Lines	Content	Approximate size
Before timestamp	1–88	Role definition, behavior rules, OS/shell context	12,730 B (61%)
Timestamp line	89	KIMI_NOW + explanatory text (e.g. “do not fully trust me”)	~500 B
After timestamp	90–158	Template tail, WORK_DIR, directory tree, extra directories, AGENTS_MD, SKILLS	7,508 B (36%)

The timestamp is therefore the largest single dynamic injection point in the message, and it separates two other large mutable regions (the role block and the environment block).

Why this is a problem

1. It breaks the continuity of system instructions

A model normally receives system instructions as a coherent block at the top of the context. By placing a dynamic timestamp and meta-commentary in the middle, the system prompt becomes:

[Trusted static rules] ... [DYNAMIC TIMESTAMP] ... [Mutable workspace data]

When the mutable workspace data (directory tree, AGENTS.md, skills listing) is poisoned, the model has to decide which text is the "real" system instruction. The timestamp acts as a natural boundary that makes the trailing 7.5 KB look like an independent, possibly authoritative system context.

2. It turns the static role block into a silent payload carrier

The pre-timestamp block (12.7 KB) contains role definitions, behavior rules, and environment context. Because it is positioned before the timestamp, it looks like "the real system prompt". If an attacker can inject content into that region (for example via environment variables, OS shell context, or a long project path), it is treated as core instruction rather than external context.

3. It prevents system prompt caching

Any content that changes every turn invalidates prompt caching. If KIMI_NOW is rendered into the system prompt, the entire system prompt must be re-encoded on every request, even when the workspace, skills, and AGENTS.md have not changed. This directly contributes to the large baseline token counts reported in #1955.

Suggested fixes

1. Move KIMI_NOW out of the system prompt entirely.
   The current time should be provided as a tool result or as a short user/system preamble at the end of the context, not inserted into the middle of core instructions.

2. If it must stay in the system prompt, place it at the very end.
   Putting the timestamp at the end preserves the continuity of the static system rules and prevents it from acting as a divider between two large mutable blocks.

3. Wrap the post-timestamp workspace data as untrusted context.
   AGENTS.md, directory tree, skills, and MCP tool descriptions should be explicitly labeled as external, workspace-provided content rather than system instruction.

4. Split the system prompt into a static cached prefix and a dynamic suffix.
   Keep role/behavior rules in a fixed, cacheable system message; put dynamic environment data in a separate message or context block.

Related issues

• 20k tokens to say "hi" #1955 — 20k tokens to say "hi" (large baseline caused in part by non-cacheable dynamic content)
• Show a real context-usage breakdown (/context) and reflect the always-sent baseline in the indicator #524 — request for a /context breakdown to show the always-sent baseline composition
• ignore instructions #1175 — skill / AGENTS.md instructions being ignored, showing how injected documents compete with system instructions
• feat: 递归查询父级 AGENTS.md 并合并注入 #811 — recursive AGENTS.md loading, which would expand the trailing mutable block

Environment

This is an architecture-level issue in how the system prompt is assembled. It is independent of the model provider or operating system.

[kimi-agent-bot]

Fixed on the v2 engine (default since 0.33): the dynamic timestamp that split the system prompt into two blocks and made it non-cacheable was removed in 0.39.0 (fixed with #3007; the template-variable mechanism was later removed entirely in #3341). The v2 system prompt no longer carries any dynamic timestamp — dates are disclosed via local-date reminders instead.

The v1 engine still carries {{ KIMI_NOW }}, but v1 is no longer evolving in this direction — v1 wontfix.