Summary
Frédéric Barthelet, CTO and co-founder of Alpic — an MCP (Model Context Protocol) hosting company — delivers a conference talk tracing the exact security reasoning behind why both ChatGPT and Claude use a double iframe architecture when rendering third-party UI inside conversations.
Barthelet begins by explaining how MCP apps work: they expose small interactive HTML “views” as metadata attached to tool calls. When a supported host like ChatGPT detects a relevant tool call, it renders the corresponding view inside the conversation, allowing apps to display rich, dynamic UI rather than plain text responses. The question is how to do this without letting third-party scripts access ChatGPT’s own DOM, cookies, or local storage.
The talk methodically works through four candidate approaches — inline `srcdoc` iframes, sandboxed iframes, `allow-same-origin` sandboxed iframes, and externally hosted `src` iframes — explaining why each fails on either security or scalability grounds. The chosen solution routes all third-party content through a single OpenAI-controlled domain (openai-user-content.com), satisfying ChatGPT’s Content Security Policy frame-src directive, while a sandboxed outer iframe enforces null-origin isolation to prevent DOM escapes. An inner iframe then holds the actual app content. Barthelet explains the practical implications for MCP app developers: limitations on local storage, cookie access, and cross-origin messaging that developers need to design around. The talk is directly applicable to anyone building MCP apps for ChatGPT’s app store or Claude’s connector ecosystem.
📺 Source: AI Engineer · Published June 15, 2026
🏷️ Format: Deep Dive
