**Yes—there is meaningful security risk, particularly when running agents or enabling remote access.** At commit `d13fc84`, I would treat T3 Code as a privileged remote-control tool for your development machine.

My targeted source and documentation review found these concerns:

| Risk | What it means |
|---|---|
| **Full access is the initial default** | Agents can run commands and edit files without approval prompts. A mistaken instruction or prompt injection could therefore cause damage using your account’s permissions. [Permission modes](https://github.com/pingdotgg/t3code/blob/d13fc846700e5bb7d63e1bfaabb1e55733912b21/docs/user/permission-modes.md) |
| **Projects are not filesystem sandboxes** | A connection with `filesystem:read` can read files outside the selected project if your operating-system account can read them. That potentially includes private source, `.env` files, and credential files. [Authentication boundary](https://github.com/pingdotgg/t3code/blob/d13fc846700e5bb7d63e1bfaabb1e55733912b21/docs/internals/environment-auth.md) |
| **Normal pairing grants powerful access** | The documented default includes shell and agent operation. The project explicitly explains that these capabilities can be used to mint sessions with every scope. A compromised paired device or session could therefore mean compromise of your user account. [Pairing authority](https://github.com/pingdotgg/t3code/blob/d13fc846700e5bb7d63e1bfaabb1e55733912b21/docs/internals/environment-auth.md) |
| **Cloud access adds another trusted party** | T3 Connect uses proof-bound credentials, but its own documentation states that a compromised relay signing key remains dangerous. This is a trust assumption, not a vulnerability I demonstrated. [T3 Connect design](https://github.com/pingdotgg/t3code/blob/d13fc846700e5bb7d63e1bfaabb1e55733912b21/docs/internals/t3-connect.md) |
| **The install command is not pinned to your linked commit** | The README’s `curl … \| sh` executes a live installer, and `npx t3@latest` fetches the current package. Neither guarantees you install the code reviewed here. [Installation instructions](https://github.com/pingdotgg/t3code/blob/d13fc846700e5bb7d63e1bfaabb1e55733912b21/README.md) |

There are also positive controls: the code defines RPC permissions and scoped sessions, and the documented authentication design includes one-time pairing and proof-bound tokens. **I did not establish an authentication bypass or find evidence of deliberate malicious behavior in the material inspected.** That does not establish that the tool is safe. [Authorization implementation](https://github.com/pingdotgg/t3code/blob/d13fc846700e5bb7d63e1bfaabb1e55733912b21/apps/server/src/auth/RpcAuthorization.ts)

My recommendation for trying it:

- Use a disposable VM or a separate OS account without personal credentials.
- Set new threads to **Supervised**, and check existing threads separately.
- Start with local access; enable remote connections only when needed.
- Pin an exact release and inspect the downloaded installer before executing it.

This was a targeted static review, not a complete audit of dependencies, release binaries, or runtime behavior. I would **avoid first testing it on a machine holding production credentials**.

Fixed but not yet released (awaiting review): Nothing.