Google releases Three-Live v1.0.0: sandboxed compiler for AI-generated Three.js to 3D/AR/WebXR

Google's Antigravity team has released Three-Live v1.0.0 Developer Preview, an open-source project that addresses the security and performance gap between AI-generated 3D code and production deployment. The library treats a declarative subset of Three.js as a portable scene description language, compiling it into standard binary formats rather than executing it directly in a browser rendering loop.

The project spans web, Android, iOS, and macOS with platform-optimized outputs: a 45 KB gzipped web bundle with WebGL2 PBR rendering and AR handoff, a Kotlin SDK with JNI for Google Filament on Android, and a Swift Package with XCFramework for RealityKit on Apple platforms. Security is enforced through sandboxed execution—Web Workers with stripped network primitives on web, and an embedded Rust compiler using the Boa ECMAScript engine on native platforms—plus hard timeouts and geometry quotas to prevent runaway scripts.

Architecture and security model

• Sandboxed execution tiers: Web deployments use isolated Web Workers with an optional opaque-origin sandboxed iframe layer, where fetch, XMLHttpRequest, WebSocket, and dynamic import() are stripped before any user code executes; native platforms use an embedded Rust compiler with the Boa ECMAScript engine.
• Resource quotas and timeouts: Both runtimes enforce hard execution timeouts and geometry caps on vertices, triangles, meshes, and procedural textures to prevent denial-of-service from runaway LLM-generated scripts.
• Fast binary serialization: The compiler outputs standard glTF 2.0 (.glb) and uncompressed Apple USDZ (.usdz) byte buffers in memory in approximately two to five milliseconds, enabling on-device or server-side compilation workflows.
• Web rendering stack: The three-live web component ships with a zero-dependency WebGL2 PBR renderer featuring procedural Studio HDRI reflections, SSAO, bloom, shadow mapping, and one-click AR handoff to Android Scene Viewer, Apple AR Quick Look, or immersive WebXR.
• Native mobile SDKs: Android provides a Kotlin SDK with multi-architecture JNI (arm64-v8a, armeabi-v7a, x86_64) for Google Filament; iOS/macOS provide a Swift Package with five-slice XCFramework for RealityKit ModelEntity and ARQuickLookPreviewController.

Why it matters

Three-Live fills a notable gap in the generative-AI-to-3D pipeline by treating LLM output as untrusted by default and providing a path to safe, performant execution without vendor lock-in under Apache 2.0. For Linux and open-source developers building web-based XR or mobile AR applications, the project offers a lightweight alternative to full Three.js bundles and establishes a pattern for sandboxing AI-generated code that could extend to other domains.