An XSS is a tad different than being owned (IMHO), but certainly isn't an ideal thing to see right away.

The cool part is that things like this will encourage them to put more security-by-default sorts of APIs into GAE.