Large language model applications build prompts from templates, and Handlebars is a widely used templating engine and the default prompt-template format in Microsoft Semantic Kernel. Its double-brace {x} expression HTML-escapes the interpolated value and is documented as the safe default; its triple-brace {x} expression inserts the value raw. We show that this choice silently governs an application's exposure to structural role injection, where attacker-controlled data carries chat role delimiters that forge a higher-privilege turn. A model-free analysis establishes the mechanism: Handlebars escaping rewrites angle brackets but not square brackets, colons, or Markdown hashes, so it neutralises ChatML, Llama-3, and XML role delimiters (survival rate 0.00) while leaving Llama-2 [INST], legacy Human:/Assistant:, and Markdown ### delimiters intact (survival rate 1.00 for the last two). We then run 5760 trials across seven delimiter families, two attack objectives, and four models (GPT-3.5 Turbo, GPT-4o mini, GPT-4.1 mini, Claude Haiku 4.5) at a combined API cost of 1.63 USD. GPT-3.5 Turbo follows the task-hijack instruction in 97% of raw and 91% of escaped trials, with the escaping protection concentrated in the angle-bracket families and absent for the colon- and Markdown-based families; the harder secret-exfiltration objective, which does not saturate, exposes the same family interaction more cleanly. Claude Haiku 4.5 resists both objectives almost entirely. The escaped default protects only the delimiter schemes whose characters HTML escaping happens to cover, gives no protection for the rest, and cannot substitute for a structural separation of instruction and data.

翻译：大语言模型应用从模板构建提示语，Handlebars作为广泛使用的模板引擎，是Microsoft Semantic Kernel中默认的提示模板格式。其双花括号{x}表达式会对插值内容进行HTML转义，被文档标注为安全默认值；而三花括号{x}表达式则直接插入原始值。研究表明，这一选择悄然决定着应用对结构角色注入的暴露程度——当攻击者控制的数据携带聊天角色分隔符时，可伪造出更高权限的交互轮次。通过无模型分析确立机制：Handlebars转义处理会改写尖括号，但不会改写方括号、冒号或Markdown哈希符，因此它能使ChatML、Llama-3和XML角色分隔符失效（存活率0.00），同时完整保留Llama-2的[INST]、传统Human:/Assistant:及Markdown的###分隔符（后两者存活率1.00）。我们随后进行5760次试验，涵盖七类分隔符家族、两种攻击目标及四个模型（GPT-3.5 Turbo、GPT-4o mini、GPT-4.1 mini、Claude Haiku 4.5），总API成本1.63美元。GPT-3.5 Turbo在97%的原始插入和91%的转义试验中遵循任务劫持指令，转义防护集中在尖括号家族，对冒号类和Markdown类分隔符完全失效；更困难的秘密泄露目标（未达饱和）则更清晰地呈现了相同的家族交互模式。Claude Haiku 4.5几乎完全抵御了两种攻击。默认转义机制仅保护其字符恰好被HTML转义覆盖的分隔符方案，对其他方案提供任何保护，也无法替代指令与数据的结构性分离。