Google releases Three-Live for sandboxed AI-generated 3D, AR and WebXR content

Google releases Three-Live for sandboxed AI-generated 3D, AR and WebXR content. Announced on November 3, 2026, Three-Live is an open-source Apache 2.0 Developer Preview that compiles untrusted AI-generated Three.js code into interactive 3D assets for web, Android and iOS.

Google describes Three-Live as an unofficial project, not an officially supported Google product. It was written entirely by Google Antigravity in partnership with one former software engineer turned product manager. Google presents it as a lightweight cross-platform library and on-device compiler for AI-authored 3D, AR and WebXR content.

Sandboxed compilation for generated scenes

Three-Live treats a declarative subset of the Three.js API as a portable scene-description language. Generated JavaScript can describe objects, materials, lighting and animations. The compiler runs that script in containment, reads the resulting scene graph and serializes it in memory into binary glTF, or GLB, and uncompressed USDZ for Apple platforms.

Serialization typically takes two to five milliseconds. The generated output cannot make network calls: what reaches the renderer is a file, not executable code. This separation addresses Google's stated concern that runtime AI-generated code is not trusted and requires security sandboxing for safe execution.

On the web, scripts run inside a Web Worker. An opaque-origin sandboxed iframe provides an optional second layer. Before execution, fetch, XMLHttpRequest, WebSocket and dynamic import() are stripped. Execution timeouts and geometry quotas limit vertices, triangles, meshes and procedural textures.

Android, iOS, macOS and command-line execution use the same scripts through a Rust compiler embedding Boa, an ECMAScript engine also written in Rust. A generated scene that exceeds defined geometry limits can therefore be stopped before it reaches the renderer.

Web, mobile and spatial features

The web component is the custom element <three-live>, modelled on Google's <model-viewer>. Its zero-dependency WebGL2 renderer supports PBR shading, studio HDRI reflections, SSAO, bloom and shadow mapping. AR handoff can use Android Scene Viewer, Apple AR Quick Look or WebXR.

Client-editable inline scripts require an explicit allow-client-scripts opt-in. Server-generated scripts can instead be covered by script-src. The standard web build is described as roughly 45 KB gzipped, while the XR suite is about 55 KB.

The companion <xr-live> element adds 6DoF hand gestures, spatial DOM projection for placing ordinary HTML cards beside a model in the room, and voice or text to 3D synthesis inside a running WebXR session.

Behaviour can travel inside the asset instead of separate application code. userData.interactivity maps to KHR_interactivity, while userData.xr carries traits such as grab, scale, billboard and anchor. Android receives a Kotlin SDK that feeds ByteBuffers to Filament. iOS and visionOS receive a Swift package targeting RealityKit.

Versions, package gaps and spatial additions

Google's announcement introduced v1.0.0 as a Developer Preview under the Apache 2.0 license. GitHub dates one release to October 6. Its release list shows v1.0.0, v1.1.0, v1.1.1 and v1.2.0, while the changelog dates 1.2.0 to November 3, 2026.

The npm timeline differs from the announcement. three-live 1.2.1 was published at 03:53 UTC on November 3, about 15 hours before the post appeared at 11:30 a.m. Pacific. Version 1.2.2 followed at 17:17 UTC on November 4.

The announcement's copy-and-paste snippet pins [email protected] on jsDelivr, but npm has never carried a 1.0.0, so that script tag returns a 404. The version presented in the announcement is not one that can be installed through that snippet.

Version 1.2.0 added the spatial work. It expanded the XRSpatial module to 14 plugins across web, Android and iOS. Examples include a point-to-point tape measure with live bounding-box callouts, surface and socket snapping, a gaze-dwell selector with a refractory cooldown, and an exploded-view mode for CAD assemblies. These features do not appear in Google's blog post.

Bundle figures also vary. The announcement quotes roughly 45 KB gzipped for the standard build, and its screenshot shows a 45.0 KB badge. The linked playground measured 53.2 KB on the morning of November 4, then 58.6 KB after version 1.2.2 shipped that afternoon.

Project guidance and position in Google's XR stack

VR.org News reports that the repository contains a root AGENTS.md file and a skills directory. The playground gathers /llms.txt, /llms-full.txt, a cookbook and a SKILL.md under a hea.

Google describes Three-Live as an unofficial companion to XR Blocks, Android XR's more capable and feature-rich web-based cross-platform framework for XR. Three-Live focuses on getting started with AI-authored Three.js across web and native mobile pipelines while retaining sandboxing for untrusted LLM-generated JavaScript.

The project combines portable GLB and USDZ output with native rendering paths, browser isolation and WebXR features. Its stated release is v1.0.0 Developer Preview, but the reported release, npm and bundle records show later versions and size changes around the November 3 announcement.