Nothing I found suggests the tool is malicious. It is a legitimate open-source project from Ping (Theo's company), and I found no published advisories or CVEs for it. The real risk is in what it's built to do: let AI agents run commands on your machine, possibly from other devices. Some of its defaults are permissive.

I read the README, `package.json` and the docs at that commit. I did not audit the source code line by line, so this is a review of the design and its documented behavior, not a code audit.

## What the docs say

**1. New threads default to "Full access."** `docs/user/permission-modes.md` says the initial default is *Full access*, so agents can run shell commands and edit files with no approval prompt. This is the biggest practical risk. A prompt injection in a repo, issue or web page the agent reads could run arbitrary commands as your user. **Change it** under Settings → General → New threads → Permissions to "Supervised" or "Auto."

**2. A local server with remote access.**
- `t3` runs a local server. `t3 service install` keeps it running in the background.
- Remote access is opt-in, through `--host` for LAN access, T3 Connect (Ping's cloud tunnel) or Tailscale. I couldn't confirm the default bind address from the docs; checking with `lsof -iTCP -sTCP:LISTEN` after you start it would settle that.
- `docs/internals/environment-auth.md` says pairing tokens get **every permission by default**. The `terminal:operate` permission is effectively a shell as your user. `filesystem:read` covers *any* file your account can read, not just the project.
- The docs openly say that limiting scopes is not a real security boundary, because a session with terminal or agent access can mint a session with full access.
- Treat pairing links and codes like passwords. Use `--scope` to limit what each device gets.
- Plain-HTTP LAN access is unencrypted. Use Tailscale HTTPS or T3 Connect instead.

**3. T3 Connect adds Ping's cloud as a trust dependency.** Your machine becomes reachable through their tunnel, and the docs don't describe how that tunnel is encrypted. If you only use the tool locally, don't enable it.

**4. Telemetry is on by default.** Usage events (provider, model, permission mode, token counts and hashed account IDs) go to `ingest.t3.codes`, then PostHog. Relay traces go to Axiom. Prompts, responses, file contents and tokens are excluded, per the docs. To opt out, set `T3CODE_TELEMETRY_ENABLED=false` in the server's environment. The browser web app doesn't read that variable.

**5. Supply chain and how you install it.**
- The recommended installers pipe a remote script into your shell (`curl | sh` or `irm | iex`). Read the script first, or use Homebrew, winget or the AUR instead.
- `npx t3@latest` runs whatever version is newest at that moment, so it isn't pinned to the commit you linked.
- The root `package.json` has no `preinstall` or `postinstall` hooks. Its `prepare` script only runs repo tooling (`effect-tsgo patch && vp config --no-agent`). Building from source does pull a large dependency tree, as any big JS/Electron app does.

**6. The project calls itself "very very early" and warns to expect bugs.** That's a fair caution for software that controls a shell and has remote access.

## Recommendations
- Switch the default permission mode away from Full access.
- Don't use `--host`, T3 Connect or `t3 service install` unless you need them. If you do, pair each device with narrow `--scope`s.
- Install through a package manager or a pinned release, not `curl | sh` or `npx …@latest`.
- Opt out of telemetry if that matters to you.
- For untrusted repos, run it in a VM, devcontainer or separate user account, since the agents get the same file and command access as the account running it.

**Bottom line:** it's reasonably safe to install, but it effectively hands a shell on your machine to AI agents and, optionally, to remote devices. Tighten those defaults before using it on a machine with sensitive data or credentials.

Sources:
- [t3code repo at d13fc84](https://github.com/pingdotgg/t3code/tree/d13fc846700e5bb7d63e1bfaabb1e55733912b21)
- [package.json](https://raw.githubusercontent.com/pingdotgg/t3code/d13fc846700e5bb7d63e1bfaabb1e55733912b21/package.json)
- [docs/user/permission-modes.md](https://raw.githubusercontent.com/pingdotgg/t3code/d13fc846700e5bb7d63e1bfaabb1e55733912b21/docs/user/permission-modes.md)
- [docs/user/remote-access.md](https://raw.githubusercontent.com/pingdotgg/t3code/d13fc846700e5bb7d63e1bfaabb1e55733912b21/docs/user/remote-access.md)
- [docs/internals/environment-auth.md](https://raw.githubusercontent.com/pingdotgg/t3code/d13fc846700e5bb7d63e1bfaabb1e55733912b21/docs/internals/environment-auth.md)
- [docs/user/telemetry.md](https://raw.githubusercontent.com/pingdotgg/t3code/d13fc846700e5bb7d63e1bfaabb1e55733912b21/docs/user/telemetry.md)
- [aitoolly.com coverage (no security issues mentioned)](https://aitoolly.com/zh/ai-news/article/2026-10-07-pingdotgg-project-t3code-surfaces-on-github-trending-with-reference-to-t3-codes-web-platform)