It has a number of security issues which have not been fixed which could be used for really interesting exploitation.

I don't think anybody's proposing to throw recursive entity definitions at Claude. Just a little light informally-defined angle-bracket markup.