diff -u b/core/modules/user/user.pages.inc b/core/modules/user/user.pages.inc
--- b/core/modules/user/user.pages.inc
+++ b/core/modules/user/user.pages.inc
@@ -18,8 +18,8 @@
  * parameter for the string to use to search for suggestions.
  *
  * @param bool $include_anonymous
- *   (optional) TRUE if the anonymous user should be autocompleted. Defaults to
- *   FALSE.
+ *   (optional) TRUE if the the name used to indicate anonymous users (e.g.
+ *   "Anonymous") should be autocompleted. Defaults to FALSE.
  *
  * @return \Symfony\Component\HttpFoundation\JsonResponse
  *   A JSON response containing the autocomplete suggestions for existing users.
@@ -32,7 +32,7 @@
       $anonymous_name = config('user.settings')->get('anonymous');
       // Allow autocompletion for the anonymous user.
       if (stripos($anonymous_name, $string) !== FALSE) {
-        $matches[$anonymous_name] = $anonymous_name;
+        $matches[$anonymous_name] = check_plain($anonymous_name);
       }
     }
     $result = db_select('users')->fields('users', array('name'))->condition('name', db_like($string) . '%', 'LIKE')->range(0, 10)->execute();