ChatGPT

Why MCP and ChatGPT Apps Use Double Iframes — Frédéric Barthelet, Alpic

Jun 15, 2026 · 20:11

Frédéric Barthelet, CTO of Alpic, explains why ChatGPT and other MCP hosts render third-party app UI inside a double iframe. He traces how simpler approaches fail: `srcdoc` shares the parent origin, letting CSP block scripts and risking data access; sandboxing removes origin storage; and `allow-same-origin` recreates the escape. The resulting double iframe—an outer iframe from a controlled subdomain loading app HTML via `srcdoc` into an inner frame—ensures isolation and prevents cross-app storage collisions. Barthelet warns developers must declare every external domain their view uses in MCP app metadata or face submission rejection, and demos Skybridge's CSP inspector that diffs declared domains against actual network calls.

Your Attention Is the Bottleneck, Not Your Agents — Zack Proser, WorkOS

Jun 11, 2026 · 25:17

Zack Proser from WorkOS argues that human attention, not agent speed, is the real bottleneck in AI-assisted coding. He proposes a sustainable stack: signal layers to filter Slack and Linear, voice-first flows at 184 wpm, remote control of agents from a phone to leverage diffuse thinking, and weekly self-improvement passes over JSONL conversation history. He also integrates an Oura ring via MCP so Claude can nudge him about sleep, emphasizing balance over burnout.