They are tweeting this from the official "@safety" account:

We've identified and are patching a XSS attack; as always, please message @safety if you have info regarding such an exploit.

http://mobile.twitter.com/safety/status/25118959058