Google Three-Live: Compile AI-Generated Three.js Into Native 3D and AR Google released Three-Live, an open-source Apache 2.0 library that compiles AI-generated Three.js scripts into static GLB or USDZ files inside a Rust sandbox in 2–5 milliseconds, then renders them natively on web, Android, and iOS without the AI-written JavaScript ever executing in front of users. The sandbox strips fetch, XMLHttpRequest, WebSocket, and dynamic import, and enforces CPU instruction fuel limits plus geometry quotas on max vertices, triangles, and meshes; Google stated that "Runtime AI-generated code is not trusted, and requires security sandboxing for safe execution." The library renders via a custom WebGL2 PBR renderer on web (roughly 78 KB gzipped, 31 KB viewer-only), Google Filament through zero-copy JNI bindings on Android, and USDZ for Apple RealityKit and AR Quick Look on iOS and visionOS, and it ships with a built-in Model Context Protocol server for AI agent integration. LLMs are good at writing Three.js. That’s settled. What Google decided was that this code should never run directly in front of your users. So they built a compiler. Three-Live https://opensource.googleblog.com/2026/11/introducing-three-live-ai-generated-3d-ar-webxr.html is an open-source Apache 2.0 library that takes AI-generated Three.js scripts, compiles them into static GLB or USDZ files inside a Rust sandbox in 2–5 milliseconds, and renders the result natively on web, Android, and iOS — without the AI-written JavaScript ever executing in front of your users. Google Does Not Trust AI-Generated Code That’s the foundational design decision here. Three-Live’s sandbox is not a performance optimization — it’s a security boundary. Before any script runs, the sandbox strips fetch , XMLHttpRequest , WebSocket , and dynamic import . It enforces CPU instruction fuel limits and geometry quotas on max vertices, triangles, and meshes. The compiled output is a static binary. It cannot phone home, loop forever, or consume unbounded memory. Google’s own framing: “Runtime AI-generated code is not trusted, and requires security sandboxing for safe execution.” This is a direct acknowledgment that the standard pattern — have an LLM generate JavaScript, run the JavaScript — is not the right approach for 3D content delivered to users at scale. Compilation runs in an embedded Rust/Boa ECMAScript engine on mobile and CLI targets, and in a sandboxed Web Worker or opaque-origin iframe on the web. The output is binary glTF 2.0 .glb or Apple USDZ .usdz — a static artifact that can be safely handed off to a renderer. One Three.js Script, Three Native Targets Once compiled, Three-Live renders with platform-native engines. On web, it uses a custom WebGL2 PBR renderer with SSAO, bloom, and shadow mapping the full package is roughly 78 KB gzipped; viewer-only is 31 KB . On Android, it integrates with Google Filament via zero-copy JNI bindings and supports Jetpack XR SceneCore. On iOS and visionOS, it outputs USDZ for Apple RealityKit and AR Quick Look. That iOS path matters. As of 2026, Safari on iPhone and iPad still has no WebXR AR support. Any web-based AR for iOS must go through AR Quick Look with a USDZ file. Three-Live generates that USDZ automatically from your Three.js source. Write the scene once; it reaches Android WebXR users, iOS AR Quick Look users, and desktop browser users from the same codebase. A developer building Vision Pro client work on the Three.js forum https://discourse.threejs.org/t/three-live-xr-live-run-procedural-three-js-natively-on-android-filament-ios-realitykit-and-webxr/96709 described the USDZ spec as “unforgiving — stored-only zip entries, 64-byte alignment, single animation track.” Hand-crafting conformant USDZ is tedious. Having a compiler enforce it automatically is the right abstraction. Getting Started Installation is a single line: npm install three-live The web component is minimal. Drop a