Google’s Three-Live Hits Beta: Run AI-Written 3D and AR Without Trusting It

If you've tried using an AI model to generate Three.js code and dropping it straight into production, you've probably thought twice about what that code might actually do. Google has. That's the core insight behind Three-Live, an open-source library that takes AI-generated Three.js scripts and compiles them into safe, deployable 3D assets — without executing the untrusted JavaScript on the user's device.

On November 5, 2026, v1.3.0 of Three-Live graduated from Developer Preview (Alpha) to Beta, marking the project's first production-ready milestone under its Apache 2.0 license.

How it works

Three-Live passes a Three.js JavaScript string into a sandboxed Rust VM powered by the Boa ECMAScript engine. That engine evaluates the script in complete isolation, captures the resulting Three.js scene graph, and serializes it directly into a binary glTF 2.0 (.glb) or USDZ buffer. The whole process takes 2–5 milliseconds. The untrusted script never reaches the browser's JavaScript runtime.

The output targets multiple platforms from a single code path: WebGL2 and WebXR on the web, Android via Filament and Jetpack XR, and iOS and visionOS via RealityKit. The runtime itself weighs in at around 50 KB.

Why this matters

The timing is deliberate. AI code generators are now fluent in Three.js — models can produce scene setups, shader configurations, and animation loops on demand. But the security question has always loomed: AI-generated code can be subtly wrong, or subtly malicious if it comes from a user-controlled prompt. Three-Live sidesteps that problem entirely by treating the script as a data format, not code to trust.

It also solves a cross-platform asset pipeline problem that's annoyed 3D web developers for years. USDZ for Apple devices and GLB for everything else have required separate authoring workflows. Three-Live generates both from the same Three.js source.

What's in Beta

The v1.3.0 changelog notes the Beta graduation as the headline change, alongside performance improvements to the Boa integration and improved USDZ material mapping for iOS. The repository includes examples, an API reference, and a playground for testing scripts locally.

For web developers who've been waiting for a safe way to put AI-generated 3D on the web, Three-Live's Beta is worth a serious look. The Apache 2.0 license means you can embed it in commercial products without restriction. The sandboxed approach means you can let users bring their own AI-generated scenes without opening a code-execution hole.

The bigger picture is what this says about the direction of AI-generated creative tools: the most useful ones won't just generate code, they'll generate verifiable artifacts that don't require you to trust the generation. Three-Live is an early, concrete example of what that looks like in practice.