Google shipped Three-Live on November 3 — an Apache 2.0 library and on-device Rust compiler that takes AI-written Three.js code and turns it into production-safe 3D and AR across web, Android, and iOS in roughly 50 KB. The reason it exists is worth pausing on: LLMs are now good enough at writing Three.js to be useful, but Google does not trust that output to run directly in front of users. So they built a compiler instead.
The Problem With AI-Generated Three.js #
Ask a modern LLM to build a 3D product configurator or an AR try-on scene in Three.js, and you will get working code most of the time. The problem surfaces when that code runs in production. Around 40% of LLM-generated code carries measurable security vulnerabilities. For Three.js specifically, the failure modes are concrete: stale API calls that break on current versions, loops that generate runaway geometry and freeze the browser, scripts that try to fetch remote assets, and in some cases imports from libraries that do not exist. Manual review helps, but it does not scale.
Three-Live’s answer is to treat AI-generated Three.js as untrusted input and compile it before it ever reaches a renderer.
How the Compiler Works #
The pipeline is straightforward. Three-Live takes a Three.js JavaScript string, runs it inside a sandboxed Rust VM powered by the Boa ECMAScript engine, and serializes the resulting scene graph directly into a binary glTF 2.0 (.glb) or USDZ buffer. The whole process takes 2–5 milliseconds. The AI-generated script never executes in a user’s browser or on their device.
The sandbox is strict by design. Network and storage globals are removed so scripts cannot make external requests. Object.prototype is frozen to prevent prototype pollution. CPU instruction fuel limits and geometry quotas — capping vertices, triangles, meshes, and procedural textures — ensure runaway scripts cannot freeze the host application. A script that tries to do too much simply fails during compilation, not at runtime.
Using It on the Web #
On the web, Three-Live ships as a <three-live> web component — the same ergonomics as Google’s <model-viewer>, but with the compilation layer built in. Drop the script tag, write Three.js directly in your HTML, and Three-Live handles the rest.
<script type="module" src="three-live-viewer.min.js"></script>
<three-live>
const geo = new THREE.TorusKnotGeometry(1, 0.3, 128, 32);
const mat = new THREE.MeshStandardMaterial({ color: 0x0055ff });
scene.add(new THREE.Mesh(geo, mat));
</three-live>
The renderer is a custom zero-dependency WebGL2 PBR engine with procedural Studio HDRI reflections, screen-space ambient occlusion, bloom, and shadow mapping. The full viewer plus compiler bundle lands at around 50 KB gzipped. For AR, a single click hands off to Android Scene Viewer, Apple AR Quick Look, or immersive WebXR — no additional configuration needed.
Android, iOS, and the CLI #
The Android SDK (com.google.threelive:compiler) is a Kotlin library with multi-architecture JNI support. It compiles Three.js strings on a background coroutine and returns a ByteBuffer you pass directly to Filament or Scene Viewer.
val glbBuffer: ByteBuffer = ThreeLiveCompiler.compile(threeJsScript)
modelViewer.loadModelGlb(glbBuffer)
iOS and visionOS get a Swift + RealityKit integration that compiles to USDZ on-device. For server-side or build-pipeline workflows, a three-live-cli binary is available for Linux, macOS, and Windows.
Why This Pattern Matters #
Compile-before-run is not a new idea in systems programming — it is how sandboxed runtimes have always worked. Applying it to AI-generated 3D code is the right move, and it is overdue. The alternative — trusting LLM output to run safely in a browser or on a mobile device — is acceptable for prototyping and unacceptable in production.
Three-Live’s scope is narrow: it handles Three.js, and it handles it well. What makes it interesting beyond the specific tool is the implicit signal from Google: “LLM writes the code, compiler validates it” is becoming a standard part of the pipeline, not an edge case. The analysis from VR.org calls it “the template for responsible AI-generated rendering” — which may be slightly ahead of where the industry is today, but not by much.
Three-Live is at Developer Preview (v1.0.0, with v1.2.4 already in the repository). Source code, prebuilt binaries, and the Android .aar and Apple .xcframework bundles are all in the google/three-live GitHub repository. Apache 2.0, no strings attached.