Why MCP and ChatGPT Apps Use Double Iframes — Frédéric Barthelet, Alpic
This talk explores the technical reasons behind the double iFrame implementation used by ChatGPT and other MCP (Meta-Conversational Platform) applications to render third-party UIs. It delves into the security implications of Content Security Policy (CSP) and sandboxing, explaining why direct iFrame embedding or using source-doc attributes are problematic. The presentation highlights the double iFrame approach as a solution to isolate third-party code while enabling necessary functionalities.
Europe 2026 20 min