Slides: Why MCP and ChatGPT Apps Use Double Iframes — Frédéric Barthelet, Alpic
Source Video
Why MCP and ChatGPT Apps Use Double Iframes — Frédéric Barthelet, Alpic
Relationship To World's Fair 2026
These slides are extracted from a public AI Engineer YouTube video connected to World's Fair 2026. Speaker-matched clips are supporting context unless later confirmed as exact session recordings; official livestream recordings are day-level/event-level source material.
Related Scheduled Sessions
- No individual scheduled session mapping has been assigned yet; treat this as an event livestream deck.
Extracted Slides
OCR text:
_ a |
a in - om ie ce | Why MCP & ChatGF
| ammm +--—. ell Double Iframes
‘| | em Pi TES i 4 g ‘ z
ae
OCR text:
N
a
Mae alg ?
Pee G Pe are
* a a anne
Sg a Tere lalM eel CMO mOUr ICCA mile Rael eels ae
red inside Al chats FO
Se
Liad and Ido experimenting with MCP-UI a
Initially released on ChatGPT as OpenAl's Apps SDK & aa
Standardized as MCP first official extension or ae :
nos Ea
ry coed ar
: |
Engineering the future of Al
OCR text:
N
. arenas
Sein Cents
i CUs Sana cd
a
bf * eee ras Oe
bd bf <
ip
oe “a iz beter ti
ry FY Views render in response to tool calls 7 *
* Roe at ar)
, c
HTML documents live in resources Sa ee eee err
Py
Views can be cached ahead of time sr te
rene Ae oe rer ee
«
a Or ee ae
| teil ee aooat
a)
. AIEngi
SUL se) a
OCR text:
NJ
NY
Before AI Apps —
lus tent Sevurtty Solis tte rated Em aY
defaglt-sre
i ee eefauit-
* bf Peer ereas [ none’ J ‘sett’ Frets: |
re wc
aa es oa
bak ae
bd
RSC “sett T cunsate-intine: J ‘nonce ]
UM 31! nttos: Puss:
SMM ‘sett’ J data: | plod:
fone ED I OS
a |
Engineering the future of Al
OCR text:
N ;
Rendering external HTML?
Pe
5d od
‘ ,
* Ld
ae ur HTML etement represents a nested browsing context,
embedding another HTML page into the current one.
. | PNP sare ass |
Svea
OCR text:
SS ;
What if — rs
inherits parent CSP without script nonce,
Engineering the future of Al
OCR text:
. oo 4
oy
roar ee ee ome Al Engineer
oo me i ell
CL eee) Ce
‘| Wa inherits parent CSP without script n
J
an
OCR text:
pp-
Thesolution-doubleiframe
specific subdomain with Cs
chatgpt.com Content-Security-Policy
script-srcnonce--https://*,chatgpt.com
AIE
frae-aroself·.stripe.com*-youtube.com
cbody>
srca*https://abo123.web-sandbox.oalusercontent.com>
<meta http-equiv='Content-Security-Policy'content=connect-src'sy-servic
<script>initializeApp(）</scriptx
ATp/>ddyJno<ATp
/body
AlEngineer
EUROPE
OCR text:
NJ
7 f t
Pel
bd bd
ace
. Bu ike) fs Tents) ed
aed
L connect Domains | Raa
[scr ipt—sre [ wedia-sec | Pa oe ms
een eT on reer)
een
4 os
eas
a
| Engi ing the fut eA
OCR text:
Build MCP Apps with
ae i
= Ore @ SKYBRIDGE
bal wy 7 mu Open-source framework for building MCP Apps
7 Parad * hi Le rae Tt
eee
Or ar a
& Star the repo mur ela aeRO man EL
Al Engineer
aU cela
OCR text:
Staybridge wg wae GEE Lena eae ames Serdeioes *
tans magic 3.0011 cc meocore, (EEE
magic ¥ batt . WES. %
x * &
bd *
ace
bd *
aan
ia
a |
| Al Engineer |
au) cela
Slide-Derived Subjects To Review
Subject extraction uses video title, related session titles/descriptions, transcript context, and OCR text when available. OCR is best-effort and should be reviewed against the embedded slide images.