We’ll break down how the widget sandbox in ChatGPT Apps works: why it’s not “a regular site in an iframe,” what limitations origin/sandbox/CSP impose, how to safely communicate with the host via
window
.
openai, and why it’s better to use React hooks in the UI layer (
useWidgetProps,
useWidgetState,
useOpenAIGlobal) instead of poking the global object directly. We’ll also discuss the boundaries of responsibility among “widget ↔ ChatGPT ↔ MCP/server,” state storage, and common mistakes.