What this is. Anaplan fixed this defect in production after the report was filed, so the original PoC can no longer fire against id1.app.anaplan.com. This page proves the defect a different way: it runs the actual shipped listener code — pasted verbatim out of both bundles, nothing paraphrased — inside a harness on a different origin from this page, and drives it with a real cross-origin postMessage. Left frame runs the listener as it shipped on 13 July; right frame runs today's listener. Same payload, same sender, same everything else. The fix is the only variable.

The one-line difference between the two frames

PRE-FIX  (index-DFriS-5T.js, archived copy sha256 d5a86582f56a…)
  vy=async t=>{if(                                       !t.data||!t.data.tool_call_id||t.data.type===Dye)return; …

CURRENT  (index-BByDTUW_.js, live now)
  Ny=async t=>{if(t.origin!==window.location.origin||!t.data||!t.data.tool_call_id||t.data.type===cSe)return; …

Listener as shipped 13 July 2026 — no origin check

waiting…

Listener as shipped today — t.origin check added

waiting…

Payload sent to both frames


 
Log


 
The harness frames render a toast and a card so the effect is visible; those two components stand in for the designer's
 notification and KPI-card components. The listener — the part the report is about — is unmodified shipped code in both frames.
 The verdict banners are driven by harness instrumentation inside the frames, because the app's own reply goes to
 window.location.origin and a real attacker never receives it.

 
Related: full evidence write-up · original attacker page against production