Your “Safe Default” Handlebars Escaping Is Half a Security Layer

You shipped Semantic Kernel. You used double-brace {{x}} because the docs called it safe. You were not protected — depending on which model and which delimiter format your attacker chose, your app was wide open anyway. Ninety-seven percent exploitation rate on GPT-3.5 Turbo. For $1.63.

What happened

Researcher Mohammadreza Rashidi dissected how Handlebars templating — the default prompt-template engine in Microsoft Semantic Kernel — handles attacker-controlled input before it reaches an LLM. The core finding: HTML escaping, Handlebars’ documented safe path, rewrites angle brackets (<, >) but ignores square brackets, colons, and Markdown hash characters. That asymmetry means it neutralises ChatML, Llama-3, and XML role delimiters (survival rate 0.00 — completely defanged) while leaving Llama-2 [INST], legacy Human:/Assistant:, and Markdown ### delimiters entirely intact (survival rate 1.00 for the last two). The attack being tested is structural role injection: a form of prompt injection vs jailbreak where user-supplied data smuggles fake chat-role turns, elevating the attacker’s instructions to system-level authority. Rashidi ran 5,760 trials across seven delimiter families, two objectives (task hijack and secret exfiltration), and four models — GPT-3.5 Turbo, GPT-4o mini, GPT-4.1 mini, Claude Haiku 4.5 — at a combined API cost of $1.63 USD. GPT-3.5 Turbo followed the task-hijack instruction in 97% of raw trials and 91% of escaped trials; the escaping protection appeared only in angle-bracket delimiter families. Claude Haiku 4.5 resisted both attack objectives almost entirely, suggesting model-level behaviour matters more than template-level escaping for the families escaping can’t cover. The study is model-free in its structural analysis — the mechanism holds regardless of which LLM is downstream — and the empirical trials confirm it. For any founder building agentic workflows on top of Semantic Kernel where users can inject content into prompts, the system prompt boundary you think you have may not exist.

Cold read

This is a controlled lab setup, not a measurement of real-world exploitation in the wild — the attacker controls the input string precisely, which is a best-case scenario for the attacker. The four models tested are a reasonable but not comprehensive sample; notably absent are Gemini, open-weight models running locally (where delimiter sensitivity may differ dramatically), and newer reasoning models. The “secret exfiltration” objective deliberately did not saturate the success rate, meaning the harder, more consequential attack scenario is less reliable than the headline task-hijack number — 97% is the easier objective. The paper’s prescription (“structural separation of instruction and data”) is correct but also obvious to anyone who has read the prompt injection literature; what’s new is the precise, quantified mapping of which delimiter families escape does and does not cover. And Claude Haiku 4.5’s near-total resistance is a data point, not a guarantee — it tells you nothing about how Claude behaves if the attacker finds a different injection vector that doesn’t rely on role delimiters.

What it means for you

• Signal maturity: 4/5 — mechanistic analysis is solid; empirical confirmation is real, even if narrow
• Who gets hurt: Any team running Microsoft Semantic Kernel with user-controlled data interpolated into Handlebars templates — especially SaaS products with RAG pipelines where document content flows into prompts
• What breaks if this is true: Your threat model for prompt injection is incomplete if it assumes HTML escaping closes the hole; you may be audited, breached, or liable for a customer data leak that your security review said was mitigated
• Why it might not land: If your production stack runs Claude or GPT-4-class models with strong system-prompt enforcement, empirical resistance is high — but “high” is not “zero” and models update
• Watch for: Microsoft Semantic Kernel releasing a patch or documentation update that explicitly warns against triple-brace interpolation with untrusted input, or adds a delimiter-aware sanitisation layer beyond HTML escaping

Forecast as of 2026-06-17

By Q4 2026, at least one widely-cited security advisory or CVE will reference Handlebars/Semantic Kernel structural role injection specifically — either from Microsoft’s own security response process or a third-party pen-testing firm — moving this from academic paper to acknowledged operational risk. If no advisory materialises by then, the finding will quietly languish as known-but-unpatched.

Source: Structural Role Injection in Handlebars-Templated LLM Prompts: Triple-Brace Interpolation, Delimiter Family, and the Limits of HTML Auto-Escaping — Mohammadreza Rashidi. https://arxiv.org/abs/2606.18120v1