Working in payment and auth integrations teaches you fast that "runs in a sandbox" isn't the same as "safe." When MCP Apps landed, letting servers render interactive HTML UIs right inside the chat, it needed stress-testing the same way any new payment flow does: assume the server is hostile, assume the channel is being watched, and trace exactly where trust is handed over versus just assumed.
This talk walks through three ways it breaks, with live demos. First, postMessage trust, what happens when origin validation is wrong or missing. Second, tool poisoning through the UI, where instructions the user never sees quietly end up in the model's context. Third, a confused-deputy case where a UI-triggered tool call uses more of the host's access than the user ever agreed to.
For each one, the failure gets mapped against what the spec says should stop it, CSP, consent prompts, auditable JSON-RPC, showing honestly what holds and what you as the implementer are still on the hook for. Leave with a checklist to run before shipping any MCP App.