When your chatbot shows you buttons, who decides what “Confirm” actually does?

What's going on

Several launches landed within a few days of each other. On November 10, 2026, Anthropic expanded Claude so that Notion, Confluence, Box and Adobe tools can open as full editors inside the chat. The same day, the Pixel Drop brought “Create My Widget” to Pixel 10 and Pixel 11 phones: you describe a widget, and Gemini builds it. On November 11, Google declared version 1.0 of the A2UI protocol stable, and Google Labs launched Tabletop, which turns a prompt into an interactive group page. Vercel's UI SDK followed on November 12.

All of these services let the AI deliver interfaces instead of text: buttons, forms, charts. The industry term is Generative UI. Under the hood, though, there are three very different approaches. Which one is in play determines who ultimately decides what a “Confirm” button does.

Three ways to put an interface in the chat

Approach 1: A third-party app in a sandboxed window. With MCP Apps, an extension of the Model Context Protocol (the open standard AI assistants use to connect to outside services), a provider's server delivers ready-made HTML with JavaScript. The chat service displays it in an iframe, an embedded browser window that, according to the official documentation, “can't access the parent page, steal cookies, or break out of its container.” The app talks to the chat only through a message channel (postMessage). Claude's new connectors use this approach. OpenAI's Apps SDK works the same way, and according to OpenAI, ChatGPT now implements the MCP Apps standard and adds its own features on top.

Approach 2: A blueprint instead of code. A2UI doesn't send code. It sends a JSON description, essentially an order form: “a date field, with a button labeled X underneath.” The app assembles this from its own pre-registered components. A catalog defines which components are allowed. According to Google's blog, the agent can only place components that developers have registered. New in 1.0: function calls in both directions (say, a flight picker that checks availability instantly), accessibility support, and SDKs for TypeScript and Dart. A side note: the blog calls 1.0 “stable,” while the specification page listed it as “Current” when we checked. We didn't find a release candidate label there.

Approach 3: The model writes the code itself. With Gemini's “Dynamic View,” according to Google Research, the model designs and codes a custom interface in HTML, CSS and JavaScript for each request. Claude's in-chat visuals, available since March 2026, are also generated HTML and SVG. Google hasn't said how Tabletop builds its pages. Securityonline classifies the tool as “vibe coding,” meaning programming by description. Create My Widget sits somewhere in between: according to the Android Developers Blog, the RemoteCompose system framework is “the engine behind Create My Widget.” Google doesn't document exactly what form Gemini's output takes.

Two of the announcements aren't a separate approach. Vercel's UI SDK (beta 0.1.0, Apache-2.0) provides more than 50 behavioral primitives, such as keyboard navigation and select lists, for React, Vue, Svelte, Solid and Web Components. It's designed for coding agents that build interfaces during development, not at runtime. According to Diario Bitcoin, it includes an agent bridge that lets agents read an interface's state and perform actions. An allow function in the app can approve or reject each of these actions. Vercel's own test shows 69 percent fewer tool calls and 61 percent less time, but it's based on a single task with three runs. AG-UI, according to CopilotKit, is a transport layer: it passes instructions along, whether they arrive in A2UI format or point to MCP Apps. The two protocols can also be combined: an A2UI renderer can run inside an MCP App and show up in Claude or ChatGPT that way.

How the sandbox works, and where it stops

At the AI Engineer conference, Frédéric Barthelet, CTO of Alpic, explained why ChatGPT and Claude use double iframes. A single iframe faces a dilemma: either it shares the chat's origin, in which case third-party code could reach the chat's storage, or it gets an opaque origin, in which case local storage doesn't work. The fix is an outer iframe on a dedicated subdomain per app, with an inner iframe containing the actual app HTML. Microsoft makes this visible: Microsoft 365 Copilot serves widgets from {hash}.widget-renderer.usercontent.microsoft.com. On top of that, each app declares which domains it's allowed to contact. This rule is called a Content Security Policy (CSP), a list of allowed servers.

Barthelet also points out the limits. Subdomains separate local storage, but cookies need their own protection. And ChatGPT's developer mode didn't enforce the CSP in the past. Most importantly: the sandbox protects the chat from the app, not you from what the app shows you. A security guide to MCP Apps on nhimg.org notes that an interface can still “display misleading content” despite the sandbox.

The missing question: what does “Confirm” really do?

With MCP Apps, the app provider draws the button. A click sends a request to the host, meaning the chat service. According to the specification, the host “may” block such requests or present them to you for approval, but it isn't required to. So each chat service decides for itself whether to ask first. ChatGPT relies on hints set by the server operator (such as “modifies data”). OpenAI stresses that these hints are no substitute for server-side checks. Microsoft's table for Microsoft 365 Copilot lists the destructiveHint as unsupported. Anthropic says you have to approve changes made by Claude, just as with regular connectors. The announcement doesn't say what Claude reads from an open app.

Security firm Backslash describes a concrete risk it calls UI mimicry: a server delivers HTML that looks like the VS Code sign-in prompt and harvests credentials. A guest post on VentureBeat sketches how prompt injection (hidden instructions in data, such as a Jira ticket) could get malicious code into an MCP App view. Both describe these as concepts, with no exploit and no CVE.

With A2UI, no third-party code arrives, which is a real advantage. The specification also requires certain functions to run only after a genuine user click (requiresUserActivation). The nhimg guide flips the argument, though: a manipulated form inherits the host app's design and is therefore “more convincing than an iframe would be.” A destructive command can also carry a harmless label. Images that load automatically from a URL when displayed could leak data, and according to the guide, the specification lacks rules for URL validation.

With generated code, label and function come from the same source: the model. Our take: if the model has been manipulated through the data it ingests, such as emails a widget pulls flight details from, both can be wrong. Google itself advises checking generated widgets for accuracy.

That confirmation dialogs can be weak is well documented, though not yet specifically for Generative UI. In July 2026, researchers at Seoul National University showed that Claude in Chrome only reported it wanted to click “an element” before clicking. Their attacks, which disguise data as trusted metadata, succeeded up to 50 percent of the time, even against defenses. Security firm Straiker documented an approval prompt in Google's Antigravity that showed only the script name gmail.py while the script uploaded SSH keys. Their conclusion:

“Human review no longer works as a real security boundary” once the AI controls its own explanation.

What data does the model see?

This, too, varies by approach. Google pitches A2UI on the promise that sensitive values “never reach the model,” because data is filled in on the server. According to the specification, nothing goes out while you type, and a click sends only the fields explicitly named. But if a developer turns on sendDataModel, the entire data model goes to the agent. With MCP Apps, an app can use ui/update-model-context to write content into the model's context for later responses. According to nhimg, that's a major entry point for prompt injection. ChatGPT lets developers separate content meant for the model from private UI-only data. Gemini's help pages warn that Google “doesn't control, monitor, or secure third-party MCP servers” and that Gemini may share information from chats with your own apps.

Who supports what today?

We found no evidence of MCP Apps support in Microsoft's consumer Copilot app.

The big picture

Generative UI is moving from developer experiment to everyday feature, and the three approaches distribute responsibility differently. With the iframe, you trust the app provider and hope the chat service guards critical clicks with its own dialog. A2UI blocks third-party code but makes forgeries visually harder to spot. With generated code, there's no third party, but the model itself becomes the weak point.

Our take: in none of the three approaches does the decisive protection live in the protocol. It lives in a confirmation drawn by the host that shows the exact action and its parameters, and in validation on the server. That's precisely what the specifications don't yet require. We found no public proofs of concept for spoofed dialogs in MCP Apps or A2UI. The risks have been described, not demonstrated. Until that changes, here's a rule of thumb: passwords, PINs and card details don't belong in forms that pop up in a chat.