中文導讀（編輯整理）
收緊設定後可合理試用；提醒預設 Full access、廣泛配對權限、遙測及 Cloud 信任。
實際閱讀範圍：README／套件設定，以及權限、遠端存取、環境認證與遙測文件。
下載完整英文原文 · SHA-256 8ccb27e39b77eb87df64cbd50d011240e0a559c6de10d6aa291a5443438e55ec
完整英文原始回覆（未翻譯）
Nothing I found suggests the tool is malicious. It is a legitimate open-source project from Ping (Theo’s company), and I found no published advisories or CVEs for it. The real risk is in what it’s built to do: let AI agents run commands on your machine, possibly from other devices. Some of its defaults are permissive.
I read the README, package.json and the docs at that commit. I did not audit the source code line by line, so this is a review of the design and its documented behavior, not a code audit.
What the docs say
1. New threads default to “Full access.” docs/user/permission-modes.md says the initial default is Full access, so agents can run shell commands and edit files with no approval prompt. This is the biggest practical risk. A prompt injection in a repo, issue or web page the agent reads could run arbitrary commands as your user. Change it under Settings → General → New threads → Permissions to “Supervised” or “Auto.”
2. A local server with remote access.
t3runs a local server.t3 service installkeeps it running in the background.- Remote access is opt-in, through
--hostfor LAN access, T3 Connect (Ping’s cloud tunnel) or Tailscale. I couldn’t confirm the default bind address from the docs; checking withlsof -iTCP -sTCP:LISTENafter you start it would settle that. docs/internals/environment-auth.mdsays pairing tokens get every permission by default. Theterminal:operatepermission is effectively a shell as your user.filesystem:readcovers any file your account can read, not just the project.- The docs openly say that limiting scopes is not a real security boundary, because a session with terminal or agent access can mint a session with full access.
- Treat pairing links and codes like passwords. Use
--scopeto limit what each device gets. - Plain-HTTP LAN access is unencrypted. Use Tailscale HTTPS or T3 Connect instead.
3. T3 Connect adds Ping’s cloud as a trust dependency. Your machine becomes reachable through their tunnel, and the docs don’t describe how that tunnel is encrypted. If you only use the tool locally, don’t enable it.
4. Telemetry is on by default. Usage events (provider, model, permission mode, token counts and hashed account IDs) go to ingest.t3.codes, then PostHog. Relay traces go to Axiom. Prompts, responses, file contents and tokens are excluded, per the docs. To opt out, set T3CODE_TELEMETRY_ENABLED=false in the server’s environment. The browser web app doesn’t read that variable.
5. Supply chain and how you install it.
- The recommended installers pipe a remote script into your shell (
curl | shorirm | iex). Read the script first, or use Homebrew, winget or the AUR instead. npx t3@latestruns whatever version is newest at that moment, so it isn’t pinned to the commit you linked.- The root
package.jsonhas nopreinstallorpostinstallhooks. Itspreparescript only runs repo tooling (effect-tsgo patch && vp config --no-agent). Building from source does pull a large dependency tree, as any big JS/Electron app does.
6. The project calls itself “very very early” and warns to expect bugs. That’s a fair caution for software that controls a shell and has remote access.
Recommendations
- Switch the default permission mode away from Full access.
- Don’t use
--host, T3 Connect ort3 service installunless you need them. If you do, pair each device with narrow--scopes. - Install through a package manager or a pinned release, not
curl | shornpx …@latest. - Opt out of telemetry if that matters to you.
- For untrusted repos, run it in a VM, devcontainer or separate user account, since the agents get the same file and command access as the account running it.
Bottom line: it’s reasonably safe to install, but it effectively hands a shell on your machine to AI agents and, optionally, to remote devices. Tighten those defaults before using it on a machine with sensitive data or credentials.
Sources: