A senior figure in the Somali militant group al-Shabab has told the BBC it carried out a deadly attack on a shopping centre in neighbouring Kenya.
Kenyan President Uhuru Kenyatta said 39 people had been killed, including members of his family, and 150 injured.
The operation to secure the mall and catch the gunmen was ongoing, he said in a national TV address.
Al-Shabab, which has links to al-Qaeda, said the attack was in response to Kenya's presence in Somalia.
There are about 4,000 Kenyan troops in southern Somalia, where they have been fighting the militants since 2011.
On its Twitter feed, al-Shabab said it was behind what it called the "Westgate spectacle".
In his TV address, Kenyatta said security forces were "in the process of neutralising the attackers and securing the mall".
He went on: "We shall hunt down the perpetrators wherever they run to. We shall get to them and we shall punish them for this heinous crime."
He said he had "personally lost family members in the Westgate attack".
The attackers entered the Westgate centre at about 12:00 local time (09:00 GMT), throwing grenades and firing automatic weapons.
Dozens of shoppers fled; many were trapped inside. Officers have been going from shop to shop to secure the area.
Some seven hours after the assault began, al-Shabab said on Twitter that its fighters were still battling Kenyan security forces inside the Westgate centre.
A security source told the AFP news agency police and soldiers had finally "pinned down" the gunmen in one corner of the shopping centre after several hours of fighting.
One gunman was arrested and died of his wounds, Kenyan officials told the BBC. Four other gunmen were arrested.
Al-Shabab has claimed on its Twitter account that the Kenyan government wants to negotiate an end to the Westgate attack, but officials have told the BBC they intend to hunt the gunmen down.