diff --git a/core/lib/Drupal/Component/Utility/SafeMarkup.php b/core/lib/Drupal/Component/Utility/SafeMarkup.php
index b4e0989..2086cce 100644
--- a/core/lib/Drupal/Component/Utility/SafeMarkup.php
+++ b/core/lib/Drupal/Component/Utility/SafeMarkup.php
@@ -7,6 +7,8 @@
 
 namespace Drupal\Component\Utility;
 
+use Drupal\Component\Utility\Xss;
+
 /**
  * Manages known safe strings for rendering at the theme layer.
  *
@@ -15,9 +17,9 @@
  * provides a store for known safe strings and methods to manage them
  * throughout the page request.
  *
- * Strings sanitized by self::checkPlain() and self::escape() are automatically
- * marked safe, as are markup strings created from @link theme_render render
- * arrays @endlink via drupal_render().
+ * Strings sanitized by self::checkPlain(), self::escape() and self::format()
+ * are automatically marked safe, as are markup strings created from
+ * @link theme_render render arrays @endlink via drupal_render().
  *
  * This class should be limited to internal use only. Module developers should
  * instead use the appropriate
@@ -205,25 +207,24 @@ public static function checkPlain($text) {
    *     @code
    *       <em class="placeholder">text output here.</em>
    *     @endcode
-   *   - !variable: Inserted as is, with no sanitization or formatting. Only
+   *   - !variable: If the string is safe, it will be inserted as is, with no
+   *     sanitization or formatting. If the string is unsafe, a very permissive
+   *     XSS/HTML filter for admin-only use will be applied. Only
    *     use this when the resulting string is being generated for one of:
    *     - Non-HTML usage, such as a plain-text email.
    *     - Non-direct HTML output, such as a plain-text variable that will be
    *       printed as an HTML attribute value and therefore formatted with
    *       self::checkPlain() as part of that.
-   *     - Some other special reason for suppressing sanitization.
+   *     - Some other special reason for suppressing HTML escaping.
    *
    * @return string
-   *   The formatted string, which is marked as safe unless sanitization of an
-   *   unsafe argument was suppressed (see above).
+   *   The formatted string, which is marked as safe.
    *
    * @ingroup sanitization
    *
    * @see t()
    */
   public static function format($string, array $args) {
-    $safe = TRUE;
-
     // Transform arguments before inserting them.
     foreach ($args as $key => $value) {
       switch ($key[0]) {
@@ -239,17 +240,18 @@ public static function format($string, array $args) {
           break;
 
         case '!':
-          // Pass-through.
           if (!static::isSafe($value)) {
-            $safe = FALSE;
+            // XSS admin filtered.
+            $args[$key] = Xss::filterAdmin($value);
+          }
+          else {
+            // Pass-through.
           }
       }
     }
 
     $output = strtr($string, $args);
-    if ($safe) {
-      static::$safeStrings[$output]['html'] = TRUE;
-    }
+    static::$safeStrings[$output]['html'] = TRUE;
 
     return $output;
   }
diff --git a/core/lib/Drupal/Core/StringTranslation/TranslationInterface.php b/core/lib/Drupal/Core/StringTranslation/TranslationInterface.php
index c3e2f68..47c052a 100644
--- a/core/lib/Drupal/Core/StringTranslation/TranslationInterface.php
+++ b/core/lib/Drupal/Core/StringTranslation/TranslationInterface.php
@@ -25,7 +25,8 @@
    *   A string containing the English string to translate.
    * @param array $args
    *   An associative array of replacements to make after translation. Based
-   *   on the first character of the key, the value is escaped and/or themed.
+   *   on the first character of the key, the value is escaped and/or themed
+   *   (%, @), or XSS admin filtered if unsafe (!).
    *   See \Drupal\Component\Utility\SafeMarkup::format() for details.
    * @param array $options
    *   An associative array of additional options, with the following elements:
@@ -34,7 +35,7 @@
    *   - 'context': The context the source string belongs to.
    *
    * @return string
-   *   The translated string.
+   *   The translated string, which is marked as safe.
    *
    * @see \Drupal\Component\Utility\SafeMarkup::format()
    */
@@ -74,14 +75,15 @@ public function translate($string, array $args = array(), array $options = array
    *   An associative array of replacements to make after translation. Instances
    *   of any key in this array are replaced with the corresponding value.
    *   Based on the first character of the key, the value is escaped and/or
-   *   themed. See \Drupal\Component\Utility\SafeMarkup::format(). Note that you do
+   *   themed (%, @), or XSS admin filtered if unsafe (!).
+   *   See \Drupal\Component\Utility\SafeMarkup::format(). Note that you do
    *   not need to include @count in this array; this replacement is done
    *   automatically for the plural cases.
    * @param array $options
    *   An associative array of additional options. See t() for allowed keys.
    *
    * @return string
-   *   A translated string.
+   *   A translated string, which is marked as safe.
    *
    * @see self::translate()
    * @see t()
diff --git a/core/modules/migrate/tests/src/Unit/MigrateExecutableTest.php b/core/modules/migrate/tests/src/Unit/MigrateExecutableTest.php
index eb1097c..6387c17 100644
--- a/core/modules/migrate/tests/src/Unit/MigrateExecutableTest.php
+++ b/core/modules/migrate/tests/src/Unit/MigrateExecutableTest.php
@@ -32,6 +32,8 @@ class MigrateExecutableTest extends MigrateTestCase {
    */
   protected $message;
 
+  protected $stringTranslation;
+
   /**
    * The tested migrate executable.
    *
@@ -53,13 +55,14 @@ protected function setUp() {
     $event_dispatcher = $this->getMock('Symfony\Component\EventDispatcher\EventDispatcherInterface');
     $this->executable = new TestMigrateExecutable($this->migration, $this->message, $event_dispatcher);
     $this->executable->setStringTranslation($this->getStringTranslationStub());
+    $this->stringTranslation = $this->getStringTranslationStub();
   }
 
   /**
    * Tests an import with an incomplete rewinding.
    */
   public function testImportWithFailingRewind() {
-    $exception_message = $this->getRandomGenerator()->string();
+    $exception_message = $this->getRandomGenerator()->name();
     $source = $this->getMock('Drupal\migrate\Plugin\MigrateSourceInterface');
     $source->expects($this->once())
       ->method('rewind')
diff --git a/core/modules/system/src/Tests/Common/XssUnitTest.php b/core/modules/system/src/Tests/Common/XssUnitTest.php
index f1358e0..74300b7 100644
--- a/core/modules/system/src/Tests/Common/XssUnitTest.php
+++ b/core/modules/system/src/Tests/Common/XssUnitTest.php
@@ -41,7 +41,7 @@ function testT() {
     $text = t('Placeholder text: %value', array('%value' => '<script>'));
     $this->assertEqual($text, 'Placeholder text: <em class="placeholder">&lt;script&gt;</em>', 't replaces, escapes and themes string.');
     $text = t('Verbatim text: !value', array('!value' => '<script>'));
-    $this->assertEqual($text, 'Verbatim text: <script>', 't replaces verbatim string as-is.');
+    $this->assertEqual($text, 'Verbatim text: ', 't XSS admin filters string.');
   }
 
   /**
diff --git a/core/modules/system/src/Tests/Theme/TwigTransTest.php b/core/modules/system/src/Tests/Theme/TwigTransTest.php
index 21aef18..8da441e 100644
--- a/core/modules/system/src/Tests/Theme/TwigTransTest.php
+++ b/core/modules/system/src/Tests/Theme/TwigTransTest.php
@@ -139,7 +139,7 @@ protected function assertTwigTransTags() {
     );
 
     $this->assertRaw(
-      'PAS-THRU: &"<>',
+      'Y U NO LET ME XSS: &amp;"&lt;&gt;',
       '{{ token|passthrough }} was successfully translated and prefixed with "!".'
     );
 
@@ -149,7 +149,7 @@ protected function assertTwigTransTags() {
     );
 
     $this->assertRaw(
-      'DIS complex token HAZ LENGTH OV: 3. IT CONTAYNZ: <em class="placeholder">12345</em> AN &amp;&quot;&lt;&gt;. LETS PAS TEH BAD TEXT THRU: &"<>.',
+      'DIS complex token HAZ LENGTH OV: 3. IT CONTAYNZ: <em class="placeholder">12345</em> AN &amp;&quot;&lt;&gt;. LETS FIRRTER TEH BAD TXT: &amp;"&lt;&gt;',
       '{{ complex.tokens }} were successfully translated with appropriate prefixes.'
     );
 
@@ -253,14 +253,14 @@ protected function poFileContents($langcode) {
 msgid "Escaped: @string"
 msgstr "ESCAPEE: @string"
 
-msgid "Pass-through: !string"
-msgstr "PAS-THRU: !string"
+msgid "Admin filtered: !string"
+msgstr "Y U NO LET ME XSS: !string"
 
 msgid "Placeholder: %string"
 msgstr "PLAYSHOLDR: %string"
 
-msgid "This @token.name has a length of: @count. It contains: %token.numbers and @token.bad_text. Lets pass the bad text through: !token.bad_text."
-msgstr "DIS @token.name HAZ LENGTH OV: @count. IT CONTAYNZ: %token.numbers AN @token.bad_text. LETS PAS TEH BAD TEXT THRU: !token.bad_text."
+msgid "This @token.name has a length of: @count. It contains: %token.numbers and @token.bad_text. Let's filter the bad text: !token.bad_text."
+msgstr "DIS @token.name HAZ LENGTH OV: @count. IT CONTAYNZ: %token.numbers AN @token.bad_text. LETS FIRRTER TEH BAD TXT: !token.bad_text."
 
 msgctxt "Lolspeak"
 msgid "I have context."
diff --git a/core/modules/system/tests/modules/twig_theme_test/templates/twig_theme_test.trans.html.twig b/core/modules/system/tests/modules/twig_theme_test/templates/twig_theme_test.trans.html.twig
index 9623ba5..ed88644 100644
--- a/core/modules/system/tests/modules/twig_theme_test/templates/twig_theme_test.trans.html.twig
+++ b/core/modules/system/tests/modules/twig_theme_test/templates/twig_theme_test.trans.html.twig
@@ -49,10 +49,11 @@
 </div>
 <div>
   {% trans %}
-    Pass-through: {{ string|passthrough }}
+    Admin filtered: {{ string|passthrough }}
   {% endtrans %}
 </div>
 <div>
+<div>
   {% trans %}
     Placeholder: {{ string|placeholder }}
   {% endtrans %}
@@ -63,7 +64,7 @@
 {% set count = token|length %}
 <div>
   {% trans %}
-    This {{ token.name }} has a length of: {{ count }}. It contains: {{ token.numbers|placeholder }} and {{ token.bad_text }}. Lets pass the bad text through: {{ token.bad_text|passthrough }}.
+    This {{ token.name }} has a length of: {{ count }}. It contains: {{ token.numbers|placeholder }} and {{ token.bad_text }}. Let's filter the bad text: {{ token.bad_text|passthrough }}.
   {% endtrans %}
 </div>
 
diff --git a/core/tests/Drupal/Tests/Component/Utility/SafeMarkupTest.php b/core/tests/Drupal/Tests/Component/Utility/SafeMarkupTest.php
index 1278a6d..0024349 100644
--- a/core/tests/Drupal/Tests/Component/Utility/SafeMarkupTest.php
+++ b/core/tests/Drupal/Tests/Component/Utility/SafeMarkupTest.php
@@ -166,13 +166,11 @@ function providerCheckPlain() {
    *   The expected result from calling the function.
    * @param string $message
    *   The message to display as output to the test.
-   * @param bool $expected_is_safe
-   *   Whether the result is expected to be safe for HTML display.
    */
-  function testFormat($string, $args, $expected, $message, $expected_is_safe) {
+  function testFormat($string, $args, $expected, $message) {
     $result = SafeMarkup::format($string, $args);
     $this->assertEquals($expected, $result, $message);
-    $this->assertEquals($expected_is_safe, SafeMarkup::isSafe($result), 'SafeMarkup::format correctly sets the result as safe or not safe.');
+    $this->assertEquals(TRUE, SafeMarkup::isSafe($result), 'SafeMarkup::format correctly sets the result as safe for HTML display.');
   }
 
   /**
@@ -181,13 +179,13 @@ function testFormat($string, $args, $expected, $message, $expected_is_safe) {
    * @see testFormat()
    */
   function providerFormat() {
-    $tests[] = array('Simple text', array(), 'Simple text', 'SafeMarkup::format leaves simple text alone.', TRUE);
-    $tests[] = array('Escaped text: @value', array('@value' => '<script>'), 'Escaped text: &lt;script&gt;', 'SafeMarkup::format replaces and escapes string.', TRUE);
-    $tests[] = array('Escaped text: @value', array('@value' => SafeMarkupTestSafeString::create('<span>Safe HTML</span>')), 'Escaped text: <span>Safe HTML</span>', 'SafeMarkup::format does not escape an already safe string.', TRUE);
-    $tests[] = array('Placeholder text: %value', array('%value' => '<script>'), 'Placeholder text: <em class="placeholder">&lt;script&gt;</em>', 'SafeMarkup::format replaces, escapes and themes string.', TRUE);
-    $tests[] = array('Placeholder text: %value', array('%value' => SafeMarkupTestSafeString::create('<span>Safe HTML</span>')), 'Placeholder text: <em class="placeholder"><span>Safe HTML</span></em>', 'SafeMarkup::format does not escape an already safe string themed as a placeholder.', TRUE);
-    $tests[] = array('Verbatim text: !value', array('!value' => '<script>'), 'Verbatim text: <script>', 'SafeMarkup::format replaces verbatim string as-is.', FALSE);
-    $tests[] = array('Verbatim text: !value', array('!value' => SafeMarkupTestSafeString::create('<span>Safe HTML</span>')), 'Verbatim text: <span>Safe HTML</span>', 'SafeMarkup::format replaces verbatim string as-is.', TRUE);
+    $tests[] = array('Simple text', array(), 'Simple text', 'SafeMarkup::format leaves simple text alone.');
+    $tests[] = array('Escaped text: @value', array('@value' => '<script>'), 'Escaped text: &lt;script&gt;', 'SafeMarkup::format replaces and escapes string.');
+    $tests[] = array('Escaped text: @value', array('@value' => SafeMarkupTestSafeString::create('<span>Safe HTML</span>')), 'Escaped text: <span>Safe HTML</span>', 'SafeMarkup::format does not escape an already safe string.');
+    $tests[] = array('Placeholder text: %value', array('%value' => '<script>'), 'Placeholder text: <em class="placeholder">&lt;script&gt;</em>', 'SafeMarkup::format replaces, escapes and themes string.');
+    $tests[] = array('Placeholder text: %value', array('%value' => SafeMarkupTestSafeString::create('<span>Safe HTML</span>')), 'Placeholder text: <em class="placeholder"><span>Safe HTML</span></em>', 'SafeMarkup::format does not escape an already safe string themed as a placeholder.');
+    $tests[] = array('Verbatim text: !value', array('!value' => '<script>'), 'Verbatim text: ', 'SafeMarkup::format XSS admin filters an unsafe !replacement.');
+    $tests[] = array('Verbatim text: !value', array('!value' => SafeMarkupTestSafeString::create('<span>Safe HTML</span>')), 'Verbatim text: <span>Safe HTML</span>', 'SafeMarkup::format replaces verbatim string as-is.');
 
     return $tests;
   }
diff --git a/core/tests/Drupal/Tests/Core/StringTranslation/TranslationManagerTest.php b/core/tests/Drupal/Tests/Core/StringTranslation/TranslationManagerTest.php
index 53165c9..61b4682 100644
--- a/core/tests/Drupal/Tests/Core/StringTranslation/TranslationManagerTest.php
+++ b/core/tests/Drupal/Tests/Core/StringTranslation/TranslationManagerTest.php
@@ -34,19 +34,19 @@ protected function setUp() {
    */
   public function providerTestFormatPlural() {
     return array(
-      array(1, 'Singular', '@count plural', array(), array(), 'Singular', TRUE),
-      array(2, 'Singular', '@count plural', array(), array(), '2 plural', TRUE),
+      array(1, 'Singular', '@count plural', array(), array(), 'Singular'),
+      array(2, 'Singular', '@count plural', array(), array(), '2 plural'),
       // @todo support locale_get_plural
-      array(2, 'Singular', '@count @arg', array('@arg' => '<script>'), array(), '2 &lt;script&gt;', TRUE),
-      array(2, 'Singular', '@count %arg', array('%arg' => '<script>'), array(), '2 <em class="placeholder">&lt;script&gt;</em>', TRUE),
-      array(2, 'Singular', '@count !arg', array('!arg' => '<script>'), array(), '2 <script>', FALSE),
+      array(2, 'Singular', '@count @arg', array('@arg' => '<script>'), array(), '2 &lt;script&gt;'),
+      array(2, 'Singular', '@count %arg', array('%arg' => '<script>'), array(), '2 <em class="placeholder">&lt;script&gt;</em>'),
+      array(2, 'Singular', '@count !arg', array('!arg' => '<script>'), array(), '2 '),
     );
   }
 
   /**
    * @dataProvider providerTestFormatPlural
    */
-  public function testFormatPlural($count, $singular, $plural, array $args = array(), array $options = array(), $expected, $safe) {
+  public function testFormatPlural($count, $singular, $plural, array $args = array(), array $options = array(), $expected) {
     $translator = $this->getMock('\Drupal\Core\StringTranslation\Translator\TranslatorInterface');
     $translator->expects($this->once())
       ->method('getStringTranslation')
@@ -56,7 +56,7 @@ public function testFormatPlural($count, $singular, $plural, array $args = array
     $this->translationManager->addTranslator($translator);
     $result = $this->translationManager->formatPlural($count, $singular, $plural, $args, $options);
     $this->assertEquals($expected, $result);
-    $this->assertEquals(SafeMarkup::isSafe($result), $safe);
+    $this->assertTrue(SafeMarkup::isSafe($result));
   }
 
 }