FormalPara Key Points

Intracellular delivery of macromolecules for therapy is promising and at the same time challenging, but toxins from plants or bacteria are able to specifically translocate their toxic components to the cytosol.

Translocation routes used by toxins are of interest for delivery of macromolecules to the cytosol by toxin-based vehicles, for anti-toxin treatments, and for therapies directly using toxins as components of a drug.

The exploitation of toxins and the translocation routes they employ for reaching their site of action (in short called “toxin routes” here) has contributed to the development of therapeutic strategies in the fields of cancer therapy, antivirals, bacterial infections with toxic effects and intoxications, protein misfolding diseases such as cystic fibrosis, and for extending the space that can be reached by protein drugs to the cytosol.

1 Introduction

The number of US-approved (Food and Drug Administration-approved) proteinaceous drugs is constantly increasing [1]. Because membranes present barriers to macromolecules, the extracellular space is most easily accessible to biologics. The delivery of macromolecules to the cytosol would have enormous potential for many applications, but the implementation is challenging.

In particular, the delivery of proteins into cells offers specific opportunities, such as targeting different protein conformations, post-translational modifications, individual splice variants or a whole set of splice variants at once and different functional sites on the same protein, causing effects only in selected compartments while leaving other compartments unaffected and inducing effects on proteins independently of their half-life [2]. The intracellular delivery of antibodies as proteins would offer these opportunities in particular. Antibodies inside cells have so far mostly been used in the form of expressed binders, i.e. intracellular antibodies (intrabodies) expressed from nucleic acids [3, 4].

Many intracellular delivery methods for macromolecules are associated with some degree of membrane damage, for example, many chemicals that are used as carriers for macromolecule delivery or electroporation as a delivery method [5, 6]. Delivery of macromolecules in a way that does not result in damage to membranes might be less toxic for the cells. Toxins that need to reach the cytosol to fulfil their function demonstrate a natural path for proteins from the extracellular space to the cytosol. Depending on the toxin route, damaging the membrane may not be required for delivery to the cytosol.

We discuss the opportunities and limitations for protein delivery to the cytosol via toxin routes, the properties that cargo molecules need to possess for successful delivery and therapeutic applications that have emerged from knowledge about toxin routes. The different mechanisms by which different toxins enter cells have implications for applications. Therefore, mechanistic principles are reviewed in addition to the efficiency of the delivery and to applications related to toxin routes. Types of toxin routes, barriers to the delivery via toxin routes and applications related to toxin routes are summarised in Fig. 1.

Fig. 1
figure 1

Toxin routes and their relevance for therapeutic strategies (blue and turquoise) and barriers to delivery via toxin routes (red). Delivery may occur directly from endosomes (B) or from the endoplasmic reticulum (ER) to the cytosol by hijacking the ER-associated degradation pathway [ERAD] (A). Barriers to the delivery of toxic or non-toxic cargoes can be due to immunogenicity of the toxin-based molecules and the elimination of toxins by an immune reaction. Cargo delivery can also be reduced by routing to lysosomes, by exocytosis or by degradation by the proteasome (C). Applications (D): toxin routes can be inhibited by antibodies or small molecules at various levels including cell-binding and intracellular transport, which can be applied for anti-toxin treatments (D). Toxins have been delivered to kill cells for therapeutic purposes and also non-toxic cargoes have been delivered via toxin routes (D). (E) summarises toxin routes, barriers to delivery via toxin routes (red) and applications related to toxin routes (blue and turquoise)

Full size image

2 Toxins Acting Inside the Cell: Mechanistic Principles

Toxins that need to reach the cytosol to have an effect demonstrate how macromolecules can travel from the extracellular space to the cytosol. A detailed understanding of the mechanism by which these toxins reach their site of action is beneficial for judging the therapeutic potential of toxins as delivery vehicles for biological drugs, toxins as part of drugs or of anti-toxin treatments. Detailed knowledge about the mechanism of toxin entry into cells also helps with identifying which cargo molecules are suitable for delivery via toxin routes. In the following, they are separated into two categories, namely “based on translocation via the ER-associated degradation pathway (ERAD)” or “other mechanisms”.

2.1 Mechanistic Principles: Toxins That Exploit ERAD

Many toxins belong to the group of AB toxins, which consist of a component that binds to cells (“B” for binding to cells) and an enzymatic component that exerts the actual toxicity (“A” for active) [7]. If the target of the catalytic part of a toxin is localised in the cytosol, the active part of the toxin has to reach this compartment. One way to reach the cytosol involves hijacking components of the ERAD pathway. This pathway normally has the function of translocating misfolded proteins from the endoplasmic reticulum (ER) to the cytosol to allow their degradation by the proteasome [8,9,10,11,12]. Retrotranslocation from the ER to the cytosol may require the protein to unfold. Translocated proteins can subsequently be degraded in the cytosol by the proteasome [9, 13]. Pseudomonas exotoxin from Pseudomonas aeruginosa [14, 15], cholera toxin from Vibriae cholera [8, 14, 16], Shiga toxin from Shigella dysenteriae or Shiga-like toxin-producing bacteria (STEC) [10, 17,18,19] and ricin from the castor bean plant (Ricinus communis) [11, 14, 20] may exploit the ERAD pathway.

2.1.1 The Uptake

The first step for toxins in following this pathway is the uptake of the toxin by the cell. Interestingly, the binding affinity of the toxin to its cellular receptor is not always most decisive for toxicity, as has been found for the Shiga toxin. The intracellular part of the transport might play an important role as well [19, 21, 22]. Although a Shiga toxin 1 (Stx-1) had a higher affinity to its receptor than a Shiga toxin 2 (Stx-2) [22], Stx-2 was more toxic in mice compared with a Stx-1 [21]. Many toxins bind to carbohydrates of cellular receptors (see Table 1).

Table 1 Examples of toxins that exploit endoplasmic reticulum-associated degradation
Full size table

2.1.2 From Endosomes to Golgi

Endocytosed molecules can move to the lysosome and are degraded there. Toxins can avoid the route towards degradation by being transported from endosomes to the Golgi. Multiple routes lead from endosomes to the Golgi, including transport from early endosomes to the Golgi and transport from late endosomes to the Golgi. Influencing the route a toxin takes and rerouting toxins from an endosome-to-Golgi path to an endosome-to-lysosome path has been suggested as a potential anti-toxin strategy [23,24,25,26].

2.1.3 From Golgi to ER

Transport from the Golgi to the ER can follow multiple paths. Some toxins contain an ER retrieval sequence (ER retrieval sequence KDEL: amino acids Lys-Asp-Glu-Leu), like Pseudomonas exotoxin or cholera toxin [27,28,29,30]. Other toxins, like Shiga toxin or ricin, do not have a KDEL signal [30,31,32,33]. Transport to the ER can depend on the KDEL receptor or it can be independent from it. For example, cytotoxicity of Pseudomonas exotoxin A was reduced in cells that overexpressed lysozyme-KDEL, but overexpression of lysozyme-KDEL did not affect the cytotoxicity of diphtheria toxin or Shiga-like toxin I. This indicates the transport of Pseudomonas exotoxin A from the Golgi to the cytosol by means of the KDEL-retrieval system, while diphtheria toxin and Shiga-like toxin I were transported independently of it [34]. A Rab6-dependent path from the Golgi to the ER might be a KDEL-independent path used by Golgi enzymes and toxins [19, 30, 35]. Even for toxins that possess a KDEL motif, like cholera toxin, the KDEL motif accelerated the toxin’s effect, but was not essential for cytotoxicity [36].

2.1.4 From ER to Cytosol

The A1 fragment of Shiga toxin forms by separation from the A2 fragment. This occurs after cleavage by furin in endosomes and in the trans-Golgi network (TGN) and after disulphide reduction in the ER [19, 37, 38]. The Shiga toxin fragment A1 interacts with chaperones in the ER that are known to be involved in the process of retrotranslocation of proteins to the cytosol. Translocation to the cytosol may be mediated by Sec61 [19, 39]. A peptide domain at the C-terminus of the A1 fragment of Shiga toxin was found to be required for retrotranslocation. The mechanism induced by this peptide domain was assumed to include hydrophobic properties or misfolding [17]. Many toxins may be able to enter ERAD based on hydrophobic properties [40]. There is also evidence for ricin reaching the cytosol by using the ERAD pathway via the translocon Sec61 [14, 20, 41]. For cholera toxin, the factors that have been suggested to be involved in its retrotranslocation include gp78, Der1, Hrd1 and Sec61 [8, 42,43,44]. Pertussis toxin was previously thought to mimic a misfolded protein by a hydrophobic C-terminus, but the hydrophobic C-terminus was not required for translocation to the cytosol. The Pertussis toxin S1 subunit (PTS1) was eventually suggested to not mimic, but to actually be a misfolded protein because of its thermal instability [12, 45, 46]. Once in the ER, the intrinsic instability of PTS1 and its resulting “misfolding” make it a substrate for ERAD [12, 46, 47]. With ERAD-defective cell lines, the role of ERAD in allowing pertussis toxin to be toxic has been confirmed [12, 47].

Cytosolic factors such as chaperones might help with a one-directional translocation through the membrane channel into the cytosol [12, 48, 49]. For example, the A1 unit of cholera toxin (CTA1) is refolded by the cytosolic chaperone Hsp90. The already folded part at the cytosolic side cannot fit back through the pore anymore [12, 49].

2.1.5 Action in the Cytosol

Having reached the cytosol without being degraded, the catalytically active domain of ricin and Shiga toxin inhibit ribosomes [19, 50,51,52]. The Shiga toxin group causes cell damage in organs that express the receptor for Shiga toxin and can lead to a severe condition called haemolytic uremic syndrome [19]. The mechanism of toxicity of pertussis toxin and cholera toxin is based on chemically modifying certain regulators of the enzyme adenylate cyclase (chemical modification: ADP ribosylation, regulators: GTP-binding proteins) [8, 12, 53]. While pertussis toxin chemically modifies an inhibitory regulator and locks it in an inactive state, cholera toxin locks a stimulating regulator in an active state [54]. In both cases, cyclic adenosine monophosphate (cAMP) increases as a consequence and leads to derailed cell signalling [8, 12]. Effects of derailed signalling include insulin secretion in the case of pertussis toxin in pancreatic cells [12, 55, 56] or chloride secretion in intestinal cells that result in massive diarrhoea in the case of cholera toxin [8, 54].

2.1.6 How Quantity and Functionality of Molecules Travelling Along Toxin Routes Develops

For toxins, the transport to the ER is associated with losses. The majority of internalised pertussis toxin is degraded in lysosomes, therefore only a fraction of it reaches the ER [12, 57].

Because the ERAD pathway normally serves the degradation of proteins, the delivery of functional toxins to the cytosol via ERAD requires at least some deviation from this path. At least a fraction of the toxins that arrive in the cytosol need to evade proteasomal degradation. The majority of ricin has been reported to be degraded in the cytosol of yeast (with only ~ 20% not being degraded) [20]. The introduction of additional lysines into the ricin toxin A subunit (RTA) enhanced degradation [20, 58]. The PTS1 subunit of pertussis toxin has no lysine residues [59]. In most cases, ubiquitin is linked to lysine. Mutated versions of PTS1 in which arginine residues had been exchanged by lysine residues showed reduced effects in cells due to degradation [12, 60]. The cholera toxin A1 domain also contains only a few lysines. However, the presence of lysines alone is not ultimately decisive for ubiquitination. The folding state of the toxin or whether chaperones bind to the translocated toxin influences whether lysines become a substrate for ubiquitination or whether they are protected from ubiquitin ligases [61].

Although RTA was suggested to be not a good substrate for ubiquitination because of its low lysine content, ubiquitin-independent degradation may occur [20, 58]. The A1 chain of cholera toxin can be degraded by the proteasome, even without ubiquitination [8, 16, 62]. PTS1 contains no lysine that would be available for ubiquitination, but may also still be degraded in the proteasome by a ubiquitination-independent mechanism owing to its intrinsic instability [12, 46].

Toxin molecules eventually have to refold after translocation across the ER membrane to the cytosol in order to be functional. In addition to ubiquitination, unfolding is also an important factor for degradation by the proteasome. Therefore, quick refolding can be a mechanism by which proteasomal degradation is evaded [52, 63]. For example, refolding of RTA might be aided by cytosolic chaperones [64]. A subunit of the proteasome might even act as a chaperone on RTA and contribute to the recovery of its catalytic activity [65]. Several toxins may exploit the ERAD pathway to reach the cytosol (Table 1), including ricin [11, 14, 20], cholera toxin [8, 14, 16], pertussis toxin [12, 47], Shiga and Shiga-like toxins [10, 17,18,19] and Pseudomonas exotoxin [14, 15].

2.2 Mechanistic Principles: Toxins Reaching the Cytosol by Other Mechanisms

Various toxins reach their site of action by a different mechanism than those that exploit the ERAD pathway (Table 2). For example, toxins may reach the cytosol by translocating from endosomes to the cytosol, as suggested for the mechanisms of Clostridioides difficile toxins, diphtheria toxin or anthrax toxin [77,78,79,80,81,82].

Table 2 Examples of toxins that exploit other mechanisms than endoplasmic reticulum-associated degradation for cytosolic access
Full size table

Diphtheria toxin is taken up into cells by receptor-mediated endocytosis [83]. A conformational change is induced upon acidification in endosomes, which leads to exposure of hydrophobic areas and insertion into the membrane. The catalytic domain subsequently transfers from endosomes to the cytosol [77, 78, 80, 84]. Diphtheria toxin has been shown to form channels in lipid bilayers based on conductance measurements [85, 86]. An open channel state was found not to be required for translocation of diphtheria toxin [87]. However, host factors might be relevant for cytosolic entry [88, 89]. Because the introduction of disulphide-bridges inhibited translocation of diphtheria toxin A (DTA) to the cytosol, unfolding might be required for translocation [90].

Anthrax toxin consists of several proteins (protective antigen; lethal factor; edema factor), which are non-toxic individually but can exert toxicity in combination [91, 92]. Upon acidification in endosomes, the protein called “protective antigen” forms pores, which allow delivery of other proteins belonging to the toxin to the cytosol (e.g. lethal factor) [82, 91, 93]. Passage of proteins through the pore requires unfolding [82, 93, 94].

3 Efficiency of Delivery Via Toxin Routes

Knowing toxin delivery efficiencies can be crucial for the success of potential applications related to toxin routes, such as the use of toxin routes for macromolecule delivery, antitoxin treatments or toxin-derived therapeutics. Many toxins possess high potency. A single molecule of some toxins in the cytosol can already be sufficient to kill a cell, such as for example, diphtheria toxin or ricin [110, 111]. Therefore, high delivery efficiency is not obligatory for a toxic effect. Lethal doses of plant-derived and bacterial toxins are often in the range of nanograms or micrograms per kilogram bodyweight [112]. Results on the efficiency with which molecules were delivered to their site of action (in short called “efficiency data” here) are therefore particularly relevant for applications using toxin routes for delivery.

3.1 Ricin Efficiency Data

Based on binding studies, approximately 107 binding sites for ricin have been estimated to be present on a single HeLa cell [113]. However, the number of molecules that reaches the cytosol is limited. For example, only about 5% of the internalised ricin co-localised with a protein in the Golgi after an hour of incubation. This corresponded to 6–8 × 104 molecules per cell in this experiment based on counting immunogold-labelled molecules in cryosections [114]. Already after 45–60 min, ricin reaches an equilibrium for entering and exiting cells. Within 15 min, ricin reaches the ER [115]. Most of the internalised ricin was found in endosomes and the lysosome. Only a fraction reaches the Golgi [114]. About 70–80% of the Golgi-associated ricin was found in the TGN [114]. Only a fraction eventually reaches the ER and the cytosol [64, 116]. Ricin has a molecular activity of about 1400 ribosomes per minute [117].

3.2 Pseudomonas Exotoxin Efficiency Data

The efficiency of cytosolic delivery of cargoes with components of Pseudomonas exotoxin was estimated by quantification of molecules by western blot based on a modification (biotinylation) that takes place in the cytosol. After 4 h and after 20 h of incubation, the cytosolic concentration of delivered molecules was similar with ~ 5 × 10−7 M molecules (4 h) or ~ 6 × 10−7 M molecules (20 h). This was calculated based on the simplified assumption of cells having a spherical shape with an average diameter of 13 µm [118]. A saturation of delivery had been observed at a concentration of 200 nM. Incubation of cells with an increased concentration of 2 µM for 4 h did not increase the cytosolic delivery further. The reasons why increased concentrations above this threshold did not increase cytosolic delivery are not entirely understood. The different levels at which cytosolic delivery are limited could in principle include receptor binding, retrograde transport to the ER (expression level of the KDEL receptor) or retrotranslocation to the cytosol (expression level of Sec61) [118].

Although a single Pseudomonas exotoxin molecule in the cytosol might be sufficient to cause cell death, usually cells need to be treated in vitro with ~ 1000 molecules per cell to kill the cell. In a mouse model, 400–750 molecules of a Pseudomonas exotoxin-based immunotoxin were required to be bound per cell for tumour remission. The majority of Pseudomonas exotoxin that has been applied might traffic to lysosomes and it has been estimated that less than 1% reach the cytosol. This estimate is based on observations from the experiments with immunotoxins, in which killing of a tumour cell typically required at least several hundred molecules, although a single molecule of Pseudomonas exotoxin in the cytosol may already be sufficient for killing the cell [119, 120].

3.3 Pertussis Toxin Efficiency Data

Most of the internalised pertussis toxin is also degraded in the lysosome and only a part reaches the Golgi and the ER [12, 57]. Only 3% of surface-associated PTS1 was delivered to the cytosol after 3 h of intoxication, representing an average of 38,000 molecules of PTS1 per cell in the cytosol according to Banerjee and colleagues [47]. Although it was possible to visualise pertussis toxin in the endocytic pathway and in the Golgi, it was not detected in the ER or cytosol by fluorescence microscopy by Plaut and Carbonetti [12, 121].

3.4 Diphtheria Toxin Efficiency Data

Diphtheria toxin has also been found to reach the cytosol as a small fraction of what is available to the cell in total. If a reduction of the disulphide bond between two fragments of the toxin is taken as a measure for cytosolic entry, then only 5–10% of the cell-bound toxin reached the cytosol in Vero cells [84, 122]. This corresponds to only 200–400 toxin molecules, if a number of approximately 4000 molecules bind to a Vero cell. Approximately this number can already cause an effect [122].

3.5 Cholera Toxin Efficiency Data

The translocation of a tagged version of CTA1 from the ER to the cytosol was investigated. The majority of the molecule that reached the cytosol was detected during a pulse chase experiment within the first hour of chase, while cytosolic levels dropped almost completely already after the second hour of chase [16]. Cholera toxin had reached the ER after 60–90 min [28]. After 1 h of chase, approximately 26–27% of the tagged version of CTA1 had translocated from the ER to the cytosol. Rapid degradation after 2–3 h was reduced in the presence of a proteasome inhibitor [16]. Tagged CTA1 versions had a half-life in the range of 71–85 min. A proteasome inhibitor increased the half-life to 120 min [16]. In an experiment that analysed the export of CTA1 from microsomes, an export of approximately 18% had been observed after 1 h [42].

3.6 Shiga Toxin Efficiency Data

As the analysis of the export of Shiga toxin (also termed verotoxin) from microsomes showed, only a fraction of the toxin molecules that are present in microsomes are translocated out of them [39]. Only 4% of the activated form of the verotoxin 1 A subunit reached the cytosol within 4 h of continuous exposure to the toxin [123].

3.7 Anthrax-Based Delivery System Efficiency Data

In experiments that used PA for delivering cargo molecules that had been linked to LF, an estimated number of 110,000 cargo molecules (construct “Lv5”: monobody HA4-7c12 linked to the N-terminal domain of LF, LFN) or 79,000 cargo molecules (construct “Lv6”: affibody ABRaf linked to LFN) had been delivered per cell [124]. The genome editing efficiency of CRISPR-associated endonuclease Cas9 (Cas9) linked to LF or other Cas9 versions was determined to be in the range of a low single-digit percentage for an anthrax-based delivery system in another study [125].

3.8 Efficiency Comparison with the TAT Peptide and Chemicals for Delivery

For comparison, the TAT peptide (residues 47–57 of the human immunodeficiency virus [HIV] TAT protein), which has often been used in the context of cellular delivery, reached the cytosol at 0.08%, 0.38% or 0.66%, if cells were incubated with concentrations of 0.2 µM, 10 µM and 20 µM, respectively [126]. Delivery of the enzymatic domain of DTA mediated by the TAT peptide was found to be 1000-fold less efficient than delivery of DTA by an anthrax toxin-based delivery system, as measured based on protein synthesis inhibition by delivered DTA. The delivery of an antibody that mimics the anthrax delivery system was also found to be more efficient than delivery by TAT [124]. A comparison of the delivery efficiencies of the cell-penetrating peptides TAT and Penetratin with delivery systems based on the toxins Pseudomonas exotoxin A, diphtheria toxin and anthrax toxin had been performed by Verdurmen and colleagues, including comparisons in four different cell lines. The number of cargo molecules detected in cells varied highly, with a range from ~ 4500 molecules to ~ 3,280,000 per cell with pronounced differences between cell lines. Cytosolic delivery efficiencies for most of the toxin-based delivery systems were higher than for cell-penetrating peptides in the comparison by Verdurmen and colleagues [127].

These results show how the efficiency of cytosolic delivery was rather limited for TAT. Cytosolic delivery methods based on chemicals are also known to have very limited delivery efficiency in the low single percentage range (1–2% reaching the cytosol [128], ~ 3.5% reaching the cytosol [129] and 1–5% of nucleic acids reaching the nucleus [130]), although delivery by chemicals is already used for approved drugs, such as coronavirus disease 2019 vaccines [6, 131,132,133,134,135]. Therefore, provided the low efficiency of delivery to the cytosol is sufficient for the application, delivery via toxin routes might be just as suitable for therapeutic strategies as approved drugs using chemicals for delivery.

3.9 Possibilities to Modulate Delivery Efficiencies

The dependence of delivery efficiency on toxicity may be low because of the high potency of toxins. Nevertheless, delivery efficiency influences toxicity. Delivery efficiency can even be increased to a certain degree. For example, the toxicity of some toxins has been observed to be increased with the ER retention signal KDEL [32, 41, 136]. Additionally, Golgi retention sequences (YQRL) may increase toxicity [136]. Delivery may be decreased if the KDEL receptor is blocked, as shown by lowered cytotoxic effects of Pseudomonas exotoxin if lysozyme-KDEL competed for binding to the KDEL receptor. Overexpression of the KDEL receptor led to increased toxic effects on cells [34]. Another example of a strategy to increase cytosolic delivery of toxins and toxin-containing drugs is inducing endosomal escape of toxins, for example by chemicals, which is often successful in vitro, but brings along challenges in view of clinical applicability [137]. This may not correspond to the natural entry path of toxins that reach the cytosol via ERAD, but may still increase the number of toxin molecules that reach the cytosol.

4 Toxins for Therapy

4.1 Therapy: Are Toxin Pathways Suitable as Delivery Routes?

Delivery of macromolecular drugs and biologicals to the cytosol remains a great challenge. Some proteinaceous toxins obviously achieve entering the cytosol, although they start from the extracellular space. Therefore, toxin routes are of interest as drug delivery routes for new therapeutic strategies. The idea of exploiting the mechanisms of toxins for delivering macromolecules has already been pursued in the 1990s [69]. For example, there have been first approaches in developing delivery systems based on diphtheria toxin [138] or with components based on Pseudomonas exotoxin A [139] for a delivery system for deoxyribonucleic acid (DNA). The systems described by Uherek et al. [138] and Fominaya and Wels [139] also contained Poly-l-Lysine as one of the components of the delivery system. This is relevant, because Poly-l-Lysine has also been used for the purpose of transfection.

Toxin routes are attractive as delivery routes for drugs because they may bypass the degradative lysosome by exploiting a retrograde pathway [30]. The use of toxin routes for drug delivery has to fulfil certain criteria to allow drug delivery to the cytosol to be effective. Important criteria include the relationship between the number of cargo molecules that can be typically delivered, the number of cargo molecules that is required for an effect and the requirement and ability of cargo molecules to refold. A criterion might also be the suitability of a cargo as an ERAD substrate. For example, misfolding of part of the toxin in the ER or properties that mimic a misfolded protein may be responsible for “labelling” the molecule as an ERAD substrate [10, 17, 46, 47, 62] and this might be required for translocation to the cytosol.

The formation of a pore by the component “protective antigen (PA)” of anthrax toxin allows delivery of the anthrax component “lethal factor (LF)”; therefore, this has been suggested as a mechanism that could be exploited for delivering chosen cargoes [69]. To use the pore originating from anthrax toxin for delivery, cargoes need to have a conformational state that allows passage through the narrow pore. For example, in a comparison by Rabideau et al., some small-molecule drugs were able to pass through the pore, while cyclic peptides and a small-molecule drug with a bigger size were not [140].

Because many toxins are highly potent, other cargo molecules have to either possess similar potency or the efficiency of delivery has to be sufficient for the lower potencies of the respective cargoes. Therefore, when using toxin routes for delivery, the combination of the delivered quantity and the cargo’s individual potency may be the decisive criterion for whether the threshold for causing an effect is reached. As a consequence, while some cargoes might not be suitable for delivery via toxin routes, the delivery via this path might be particularly suitable for other groups of cargo types. This is also valid for a potentially required ability of the cargo to refold in the cytosol.

4.1.1 Quantitative Analysis of Macromolecules Delivered Via Toxin Routes

Designed Ankyrin Repeat Proteins (DARPins) were used as a model cargo to develop an assay for quantitative detection of cytosolic delivery. The assay is based on a peptide sequence (avi-tag) that is fused to the cargo and biotinylated in the cytosol by the Escherichia coli-derived biotin ligase BirA, which was stably overexpressed in cells for this purpose. Cargoes that have successfully been delivered to the cytosol can consequently be quantified by determining the amount of biotinylated cargo. Detection can simply be achieved via SDS-PAGE and blotting, if biotinylation outside the cytosol due to mixing of contents from different compartments as a consequence of cell lysis can be excluded [118]. Because the avi-tag is not a substrate for all biotin ligases, but specifically biotinylated by the E. coli-derived biotin ligase BirA, cells that stably overexpress BirA were used for this assay [118]. The quantity of cargo that is delivered is important for any application beyond just toxin delivery. Therefore, it is of extraordinarily high value to quantify the amount of cargo that is typically delivered to the cytosol.

Delivery via the anthrax pathway was dependent on the cargo’s stability. Relatively high stability potentially lowers delivery efficiency to the cytosol [118]. Unfolding of the cargo is required for delivery through anthrax pores. The ability to translocate to the cytosol was compared for DARPins with different thermodynamic stabilities and as a conclusion, delivery through anthrax pores was suggested to be probably limited to molecules that unfold easily [141]. High stability was not limiting for delivery of Pseudomonas exotoxin A-based cargoes in the study by Verdurmen et al. from 2015 [118], although unfolding is also required for the route of Pseudomonas exotoxin A. As a potential explanation for this observation, authors suggested the unfolding machinery involved in the anthrax route to be less forceful than the machinery for translocation and unfolding of the cell, which Pseudomonas exotoxin A uses [118].

Further limitations in delivery efficiency of an anthrax-based delivery system were observed and overcome by Becker et al. by reengineering the system. The anthrax delivery system was re-engineered for preventing the toxic premature pore formation at the cell surface and to limit the occurrence of pore formation to endosomes. The reengineered anthrax delivery system allowed using higher concentrations of the constructs without increased toxicity, thus allowing higher amounts of cargoes to be delivered to the cytosol [142].

4.1.2 Assessing the Functionality of Macromolecules After Delivery Via Toxin Routes

In addition to the amount of cargo that reaches the cytosol, the portion of functional cargo is essential for therapeutic applicability. Assays using biotinylation as an indicator of cytosolic localisation may require additional analyses that provide information on how many of the molecules that reached the cytosol are also functional. Because of the often required step of unfolding, refolding for delivery and potentially escape from degradation in the cytosol, it is crucial to evaluate the functionality of delivered cargo.

Functionality can for example be evaluated in the form of gene modification upon successful delivery of functional Cas9 molecules to their site of action. An engineered version of anthrax toxin was proposed as a delivery system by Hirschenberger et al. and delivery of functional Cas9 was evaluated by monitoring the knockout of green fluorescent protein in a 293T cell line that stably expressed green fluorescent protein. It was evaluated as well by monitoring the knockout of a gene in a colon cancer cell line [125]. Briefly, the system described in this study comprises transfection of cells with plasmids for guide RNA expression and subsequent treatment of cells with a 63-kDa fragment of protective antigen from anthrax toxin and versions of the cargo molecule Cas9. Plasmids encoding guide RNAs were delivered to cells by means of chemicals for nucleic acid transfection, which were the lipid-based transfection reagent Lipofectamine 2000 or the proprietary formulation TransIT-LT1 containing “a lipid and protein/polyamine mixture” according to the manufacturer [125, 143]. Two versions of the cargo Cas9 had been applied to cells, a histidine-tagged Cas9 (His-Cas9) and Cas9 fused to the recognition domain of lethal factor for PA of anthrax toxin (LFN-Cas9). Knockouts were observed both after treating cells with His-Cas9 and a 63-kDa fragment of protective antigen or with LFN-Cas9 and a 63-kDa fragment of protective antigen [125]. The cell culture medium had been renewed after transfection of the colon cancer cell line with guide RNA-encoding plasmids [125]. Removal of transfection reagents might be a relevant detail in this context because the delivery of proteins by certain chemicals has been demonstrated [6, 144, 145]. In addition, Cas9 together with nucleic acids have been delivered to cells by various chemicals [6, 146,147,148,149]. Furthermore, histidine residues have been suggested to potentially enhance cytosolic delivery [150,151,152]. Therefore, in case of any potential delivery-enhancing effects originating from chemicals or histidines, cargoes could in such a case be imagined to possibly reach the cytosol by a mixed mechanism.

4.1.3 Suitability of Molecules for Delivery by Toxin Routes and Examples for Cargo Molecules

While some cargo molecules may not be able to refold sufficiently in the cytosol (as for example expected for antibodies), other cargo molecules might either refold readily or not even require refolding for being functional (e.g. peptides). An example for a peptide that is functional in the cytosol and has been delivered to the cytosol via a strategy that was based on a toxin route is the NF-kappaB Essential Modifier-binding peptide. The NF-kappaB Essential Modifier-binding peptide modulated intracellular signalling and ameliorated rheumatoid arthritis in murine models [153,154,155]. Another peptide that was delivered using a similar strategy consisted of seven amino acids and contained the interaction site between the cytosolic portion of a transmembrane immunoreceptor and its cytosolic adaptor. In murine models, delivery of this peptide showed effects on inflammatory disorders [156].

Molecules that are suitable for refolding, molecules that do not require folding for functionality (e.g. peptides) as well as molecules with high potency (e.g. enzymes) might be particularly suitable for delivery to the cytosol via toxin routes, but the feasibility has to be assessed for each molecule individually. A molecule type that combines the advantage of being independent from folding for functionality and possessing high potency are small interfering RNA (siRNA). An attenuated version of diphtheria toxin was used by Arnold et al. for the delivery of siRNAs to silence a survival gene and a gene that is involved in invasion and metastasis of cancer cells [157]. The attenuated diphtheria toxin had been conjugated to the siRNA. Non-targeting siRNA conjugated to the attenuated toxin or “siRNA only” were used as controls. As a positive control, siRNA with lipofectamine was used [157]. Delivery of siRNA with attenuated diphtheria toxin was performed with two genetic targets. Functional effects in the form of reduced invasion for one downregulated target or cell death for the other were observed [157]. These in vitro results can spur further in vivo studies, which may require adaptation of the strategy to in vivo conditions (e.g. chemical stabilisation of siRNAs for preventing degradation by nucleases in the in vivo environment or addressing potential issues with immunogenicity), but may bear high potential to further advance RNA interference-based therapies. Compared with approved siRNA drugs that are based on a chemical carrier for delivery, such as patisiran [131], or that are based on receptor-mediated internalisation for delivery, such as givosiran [158], the different intracellular mechanism of toxin routes might result in different delivery characteristics. It might be of interest in the future to compare quantitative delivery efficiencies and further aspects such as toxicity between the different delivery mechanisms in more detail. Small interfering RNA can be considered a “potent” cargo because gene silencing is a catalytic process. DNA is also a potent cargo, because a single or a few DNA molecules may be sufficient for an effect owing to amplification by transcription and translation [159,160,161]. Therefore, it is a suitable cargo for delivery routes with limited efficiency. Examples for delivery systems based on toxins are given in Table 3.

Table 3 Examples of the use of toxin components for the aim of cargo delivery (delivery of molecules of interest)
Full size table

4.1.4 Potential Side Effects of Exploiting Toxin Routes

“ER stress” with accumulation of misfolded proteins in the ER can trigger an unfolded protein response (UPR). Unfolded or misfolded proteins can be translocated to the cytosol via ERAD for degradation. Prolonged ER stress can eventually lead to apoptosis [168]. For example, ER stress has been observed as a potential effect of Shiga toxins, also eventually apoptosis [19, 67, 169].

4.1.5 Conclusion for Toxin Routes as Delivery Routes

Because there are proteinaceous toxins that obviously translocate to the cytosol from the extracellular space, there is proof for this type of delivery route. Several macromolecules have furthermore been delivered via toxin routes. Therefore, drug delivery via toxin routes is an option to address the persistent challenge of delivering macromolecules from the extracellular space to the cytosol, but this strategy is not generally applicable to all molecules and has to be assessed individually.

Although feasible in principle, the approach is limited to a selection of molecules that have to fulfil multiple criteria that are essential for an effect after passing toxin routes, for example, certain properties of cargo molecules as discussed previously [141]. This considerably narrows down the choice of cargo molecules. Importantly, the assessment of true delivery to the cytosol requires thorough scrutiny [145, 170]. Toxin routes may not be a universally applicable strategy for delivering macromolecules into the cell, but if a small selection of cargo types is suitable for this delivery route, delivery via toxin routes may offer considerable advantages compared to other delivery strategies. In contrast to delivery via membrane-damaging chemicals, delivery via toxin routes does not necessarily result in membrane damage. In contrast to chemical carriers that can dissociate from their cargoes or form aggregate sizes that are difficult to control with effects on in vivo usage, there is no risk of dissociation if the cargo and carrier are two proteins that are covalently linked to each other. Furthermore, specific targeting to cell types would be possible.

Promising cargoes might be molecules that are able to refold and molecules with an inherent amplification effect. Molecules that do not need to be in excess to their targets might be promising. Competitive inhibitors may only be worth considering as cargoes in case of very low-target molecule concentrations. Molecules that amplify their function (similar to nucleic acids or molecules with catalytic activity), with very few molecules being sufficient for an effect, are particularly promising, as the number of translocated molecules can be low via toxin routes.

4.2 Therapy: Implications for Toxicity and Anti-Toxin Treatments

Any potential efficiency issues that might limit the delivery via toxin routes can be a therapeutic advantage for treating diseases caused by toxins. Strategies for anti-toxin treatments can for example include the prevention of toxins from reaching their site of action by blocking the routes toxins take, or the inhibition of the toxin’s enzymatic activity. Blocking toxin routes may include blocking attachment of toxins to cells or interfering with intracellular transport [171,172,173,174]. Antibodies may also interfere with oligomerisation of toxin components or conversion of pre-pores to pores for toxins that require this step as part of their intoxication process [175,176,177]. Genome-wide screens can help with identifying host factors, which might be suitable targets for blocking toxins from entering cells [178, 179]. Alternatively, the source of toxins can be targeted, for example by eliminating toxin-producing bacteria with antibiotics or preventing infections with vaccinations [19, 180].

In particular, post-exposure antitoxins are needed because treatments for neutralising toxins outside the cell may not be effective any longer as soon as toxins are inside the cell [181]. Additionally, antibiotics can be ineffective against even lethal consequences, if the effect against bacteria alone cannot reverse the effect of already produced toxins (e.g. anthrax toxin) [92, 182]. Even an increased toxin release can be caused by lytic antibiotics [19, 183, 184].

Antibodies have been generated against various toxins [185, 186], including for example diphtheria toxin [187], Clostridioides difficile toxin [188, 189] or botulinum toxin [190,191,192]. An antibody that binds the pore-forming protein of anthrax toxin has been developed and approved as a therapeutic (raxibacumab; Abthrax) [193].

4.2.1 The Extracellular Space as a Target for Antitoxin Treatments

Translocation of toxins to their site of action can be interfered with at different levels. At the extracellular level, toxins can be prevented from binding to cells [173, 174, 194]. For example, chemical receptor analogues such as an oligosaccharide receptor analogue of the receptor Gb3 have been used as a therapeutic strategy for the Shiga toxin-hijacked receptor Gb3. Although effective in vitro, Gb3 receptor analogues were not sufficiently effective in vivo [195]. Further carbohydrate-based inhibitors have been evaluated and may be further optimised [196]. A mechanism for blocking the attachment of the toxin to the cell can, for example, be steric hindrance by an antibody, which occurs if a suitable epitope on the toxin is bound [173, 174]. For example, ricin toxin subunit B-specific antibodies that block attachment of ricin to the cell have been described [173, 174].

Preventing attachment of toxins to cells depends on multiple factors. The number of toxin receptors on cells can be high [113, 174], some toxins have more than one binding site for their receptor and a single antibody may sterically not be able to cover all binding sites simultaneously [174, 197]. Furthermore, toxins may bind promiscuously to several receptors [11, 12, 113, 198]. For example, Shiga toxin STx 2e may bind to more than one receptor [19, 199]. Additionally, pertussis toxin binds promiscuously to various glycoproteins and might enter the cell via multiple endocytosis routes [12, 198]. Ricin is known to have multiple uptake pathways because it binds to several glycoproteins or glycolipids [11, 52, 113]. Therefore, it can be challenging to completely block the uptake of these toxins.

4.2.2 The Intracellular Space as a Target for Anti-Toxin Treatments

The transport from the cell surface via the TGN to the ER can be interfered with. For example, conjugating ricin to gold particles or to horseradish peroxidase can already affect intracellular routing [200]. Inside cells, endocytosis and sorting of toxins can be interfered with at multiple individual steps of the transport process. Inhibitors have been described for preventing endocytic uptake, sorting to the Golgi apparatus, Golgi-to-ER transport and for interference with translocation from ER to cytosol (an overview of Shiga toxin uptake steps and compounds for interfering with them is provided in Table 1 and Figure 3 of the review by Kavaliauskiene et al.) [201].

Small molecules have been used to inhibit intracellular trafficking. For example, small molecules have been used to block the transport of ricin and Shiga toxin from the endosomes to the Golgi. A compound protected mice from the toxic effects of ricin [202, 203]. Targets involved in endosome-to-Golgi transport have been suggested and a range of small-molecule inhibitors for toxin trafficking have been described and suggested as a potential therapeutic strategy to protect from the effects of Shiga toxins, as reviewed by Li et al. [25].

Blocking retrotranslocation with small molecules has been described as a further strategy to prevent the effects of toxins. For example, a chemical library was screened for interference with RTA retrotranslocation using an attenuated and enhanced green fluorescent protein-labelled RTA [204]. A strategy to prevent retrotranslocation can also be based on preventing misfolding by using chemical chaperones. For example, PTS1 is an ERAD substrate because it unfolds. If unfolding is prevented by chemical chaperones that are known from therapeutic strategies against protein misfolding diseases, PTS1 loses its toxicity [12, 47].

Examples for compounds that have been suggested for inhibiting toxin trafficking include compound 134, retro-2 and manganese [25, 201, 203, 205]. Manganese has been reported to protect 3800-fold against Shiga toxin in vitro or even showed complete protection of mice to a normally lethal challenge [205].

Transport to the ER has been blocked by an antibody specific to Shiga toxin subunit A, which was presumably caused by recycling of the antibody-toxin complex back to the cell surface [172, 174]. Additionally, monoclonal antibodies have been used to prevent the retrograde transport of Shiga toxin, resulting in accumulation of the toxin in endosomes. In mice, this antibody had also protected from the effects of Shiga toxin [19, 206, 207].

An antibody specific to ricin has been reported to travel with the toxin inside the cell and to delay trafficking inside cells [115]. A bispecific antibody with specificity to two epitopes on the toxin ricin reduced the retrograde transport of ricin and resulted in endosomal accumulation instead [208]. Neutralising antibodies specific for ricin toxin subunit B as well as RTA have been reported [174, 209, 210]. Toxin-specific antibodies can be neutralising, non-neutralising or toxin enhancing [174, 189, 209, 211, 212]. Antibodies can be associated with increased uptake of the toxin ricin into cells, as has been observed for mab 24B11. This antibody does not block uptake and increases uptake instead, but still acts against toxicity because 24B11-toxin-complexes being transported to the lysosome instead of reaching the TGN [213]. In contrast to mab 24B11, which increases uptake but still has an anti-toxic effect, there are also antibodies that lead to enhanced toxicity. The mechanism of toxin-enhancing antibodies is not sufficiently understood [174, 209].

Competition for binding to the KDEL receptor has been shown to reduce the toxicity of Pseudomonas exotoxin A [34]. Therefore, the KDEL receptor could also be a potential target for interference, if short-term blockage does not affect ER homeostasis too severely and if it prevents lethal effects of the toxin.

4.2.3 Inhibiting the Enzymatic Activity of Toxins

A different strategy is the inhibition of the enzymatic activity of toxins [171, 214,215,216]. For example, small-molecule inhibitors have been described and chemical libraries have been screened for small-molecule inhibitors of ricin and Shiga toxin [171, 214, 216]. In addition, substrate analogues that inhibit the activity of the toxin by binding to its active site and which are derived from nucleic acid-based molecules have been described for ribosome inactivating proteins (RIPs) [215, 217]. Even antibodies that interfere with enzymatic activity of toxins have been described, such as the inhibition of the enzymatic activity of a Clostridioides difficile toxin [218] or the partial reduction of enzymatic activity of RTA [212], although the therapeutic applicability is difficult to imagine in case it depended on retrotranslocation of the antibody to the cytosol. However, the neutralising effect of antibodies that bind to the enzymatically active part of toxins may also originate from interference with intracellular transport. For example, antibodies specific to RTA interfered with intracellular toxin transport and probably led to degradation of the toxin in lysosomes [219].

4.2.4 Eliminating the Source of Toxin Production

A further strategy to prevent damaging effects caused by toxins is to target toxin-producing microorganisms. Antibiotics to eliminate toxin-producing bacteria or eliminating infection with these pathogens, for example by vaccinating cattle against bacteria, prevent damaging effects from toxins. However, treatment is only applicable with certain antibiotics because several antibiotics have been found to even upregulate the production of Shiga toxin and to increase severity of haemolytic uremic syndrome [19, 180, 220].

4.3 Therapy: Toxins as Drugs

Toxins and their engineered versions have been suggested for therapeutic use for achieving antiviral effects, treating protein misfolding diseases and for killing cells such as cancer cells [69, 221,222,223,224]. Suicide gene therapy, for example with diphtheria toxin expression under control of tissue-specific promoters to kill cancer cells, is another therapeutic strategy for using toxins therapeutically [80], but delivery of genes for this therapeutic strategy usually does not involve delivery via toxin routes, therefore it is not further discussed here.

4.3.1 Protein Misfolding Diseases as an Application Area for Toxins as Therapeutics

A potential application area of toxin-derived therapeutics is protein-misfolding diseases. If proteins are partially misfolded due to a mutation, they might be degraded although they might have some remaining functionality if they were not degraded. Mutant but still partly functional proteins can be rescued by temporarily saturating the ERAD pathway with toxin-derived proteins. Preventing degradation of the mutated protein via ERAD can ameliorate the pathological phenotype [69, 225,226,227]. Furthermore, ERAD inhibition might enhance folding of the mutated proteins by prolonging ER retention [225].

Cell surface expression of a mutated version of the chloride channel cystic fibrosis transmembrane conductance regulator, which leads to cystic fibrosis, was increased by inactivated cholera toxin and Shiga toxin. Inactivated toxins increased cell surface expression of the channel 20-fold and transport of chloride two-fold [226]. In addition to cystic fibrosis, treatment of further protein misfolding diseases including lysosomal storage diseases such as Gaucher disease, Krabbe disease, Fabry disease or Tay Sachs disease could potentially benefit from this therapeutic strategy. Lysosomal storage diseases are characterised by deficiencies in enzymatic activity and accumulation of metabolites [225,226,227,228,229].

The induction of the UPR might depend on the individual mechanism of interference with ERAD, but the induction of the UPR can be low if proteins are rescued by competing ERAD substrates under appropriate conditions [225, 226]. In contrast, the UPR was induced by CTB with a KDEL motif and resulted in an effect with therapeutic relevance, which was the induction of wound healing [230].

4.3.2 Vaccinations Supported by Toxins

Because the receptor for Shiga toxin (Gb3) is also expressed on dendritic cells, the subunit B of Shiga toxin has been suggested as a vehicle to internalise antigens into dendritic cells for vaccination purposes [68, 231]. Tumour antigens linked to the B subunit of Shiga toxin were able to induce antigen-specific cytotoxic T lymphocytes, although the simultaneous application of the B subunit of Shiga toxin and the tumour antigen as separate entities did not induce cytotoxic T lymphocytes [232]. In mice, the B subunit of Shiga toxin linked to an antigen of the human papillomavirus 16 protected mice from tumour cells that expressed this antigen [233]. Because linkage of antigens to the B subunit of Shiga toxin was found to allow targeting dendritic cells and eliciting specific cytotoxic T lymphocytes, this has been suggested as a vaccination strategy. While part of the molecules of the Shiga toxin B subunit was transported to lysosomes, another part underwent retrograde transport to the ER in this system, as confirmed by co-localisation with a Golgi marker and glycosylation by an enzyme in the ER [231].

4.3.3 Antiviral Immunotoxins

Immunotoxins have been developed mostly for applications in cancer therapy, but they also have been employed as an antiviral strategy. Antiviral effects of some toxins have been observed and suggested to be one of the natural functions of these toxins, for example, in plants [234, 235]. For example, the ribosome inactivating protein Pokeweed antiviral protein has been suggested to have a defence function in plants against pathogens [217, 234, 235]. The physiological role of RIPs from plants has also been suggested to be a defence mechanism of plants against being consumed by animals [236].

In plants, RIPs have been found in various compartments including vacuoles and the extracellular space [237, 238]. Wounding of plant cells might allow RIPs to enter the cytoplasm and in case breakage of the cell wall allows viral entry, protein synthesis inhibition might be a potential mechanism that confines viral spreading [224, 237, 239].

Antiviral mechanisms of RIPs include protein synthesis inhibition due to ribosome inactivation or inactivation of viral genomes by depurination due to adenine polynucleotide glycosylase activity. Therefore, viral translation, replication and transcription can be inhibited by RIPs [224, 234, 240, 241].

Antiviral activity of RIPs against a range of different types of viruses has been reported, like double-stranded DNA viruses (e.g. hepatitis B virus, HBV [242]), retroviruses (e.g. HIV [243]), positive-sense single stranded RNA viruses (e.g. Dengue virus [244]) or negative-sense single stranded RNA viruses (lymphocytic choriomeningitis virus [245]) [224]. Uptake of RIPs into cells might be aided by the endocytic uptake of viruses, which might explain why the inhibition of protein synthesis was observed to be more pronounced in infected cells [224, 246]. Activity of Shiga toxin against bovine immunodeficiency virus [247, 248], bovine leukaemia virus [248, 249] and HIV [250] has been reported.

A critical parameter of antiviral agents is a sufficient difference between concentrations with an antiviral effect and severely toxic concentrations, to ensure an effect with tolerable side effects. For some RIPs, antiviral concentrations differ substantially from their toxic concentrations [224]. For example, an antiviral effect against HIV in the form of inhibition of p24 expression and viral reverse transcriptase activity by 98% and 87% was induced by a RIP at a concentration of ~30 nM [251]. Cellular DNA and protein synthesis was not inhibited at this concentration, suggesting the absence of in vitro cytotoxicity at effective concentrations [251].

A strategy to further improve the therapeutic index of toxins is the use of immunotoxins. Immunotoxins employ targeting moieties to target toxins towards selected cells. This can be applied in antiviral therapy for selectively targeting virus-infected cells [222]. An important mechanism of action of antiviral immunotoxins is based on the eradication of infected cell populations [222, 252].

An advantage of antiviral immunotoxins compared with immunotoxins for cancer therapy is the chance to better discriminate between diseased and healthy cells. Antiviral immunotoxins allow the targeting of viral molecules that are foreign to the host cells, while targets on tumour cells are normally also expressed on healthy cells, even if expression levels are lower. Targeting viral proteins is therefore advantageous for reducing side effects [222] and may offer the potential for an improved therapeutic index of antiviral immunotoxins compared with anticancer immunotoxins.

For example, viral GPCRs (vGPCRs) such as a vGPCR from human cytomegalovirus have been targeted by immunotoxins. The immunotoxin consisted of a chemokine ligand for the vGPCR fused to the toxic domain of Pseudomonas exotoxin A. Side effects might be low because the vGPCR was targeted by a chemokine that is rarely acting as a ligand for host GPCRs (it binds to only a single host chemokine receptor) [222, 252]. This immunotoxin killed vGPCR-expressing cells and the antiviral effectiveness of the immunotoxin was superior to the virostatic small-molecule drug ganciclovir [252]. An example for a further viral factor that has been suggested as a promising target is ORF74 from Kaposi sarcoma-associated herpes virus. This factor is associated with proinflammatory and proliferative effects as well as angiogenic effects. Inhibiting each effect individually might be difficult. An immunotoxin that targets ORF74 was suggested as a promising approach to inhibit oncogenic signalling by killing KHSV-infected cells and thereby inhibiting all of these effects at once [222].

Although targeting a viral factor is advantageous to reduce side effects, host factors that are involved in viral infection could also be targeted by immunotoxins. For example, the host receptor EBI2, which is upregulated by Epstein–Barr virus [253], could be targeted by immunotoxins to counteract virus-associated diseases [222]. An advantage of targeting host proteins is their “sequence stability” compared with some more rapidly mutating virus genes. This lowers the risk for emerging drug resistance (e.g. loss of binding of immunotoxins to a mutated target).

Another relevant aspect for the choice of the target is whether it can be rapidly internalised, to allow delivery of the immunotoxin into the cell [222]. Eventually, targets are ideally of viral origin and internalise to efficiently deliver immunotoxins. Targets are ideally expressed in lytically and latently infected cells [222]. An immunotoxin allowed killing KHSV (HHV-8)-infected cells in the lytic phase in vitro, which could be of interest as a therapeutic approach for the treatment of diseases that are associated with acute infections with this virus [222, 254]. Particularly valuable would also be effective treatments for eradicating persistent reservoirs that are difficult to attack with standard treatments. For example, latently infected cell reservoirs that harbour HIV, which cannot be eradicated by the otherwise successful antiretroviral therapy, pose a requirement for further therapeutic strategies [255]. Even though immunotoxins so far have not been sufficiently effective as a monotherapy for treating HIV [255, 256], antiviral immunotoxins could still be of interest as a component of combination therapies [255, 257]. The rationale of such combination therapies is to complement the effect of suppressing new rounds of infections originating from an infected cell by antiretroviral therapy with killing infected cells by immunotoxins [255].

Examples for antiviral immunotoxins include immunotoxins directed against HIV [257, 258], herpes simplex virus 2 [259], rabies virus [260], Ebola virus [261] or human cytomegalovirus [222, 252, 262].

Many immunotoxins contain affinity reagents as their targeting moiety in contrast to ligands as targeting moieties. For example, an affinity reagent that binds a protein on the surface of herpes simplex virus 2 was combined with Pseudomonas exotoxin A to form an immunotoxin that killed virus-producing cells. As an application of this immunotoxin, the prevention of infection of other persons by the herpes simplex virus 2-positive person was proposed [259].

Challenges in the development of antiviral immunotoxins are similar to those for immunotoxins in cancer therapy, such as immunogenicity of immunotoxins. To reduce immunogenicity of toxins that are derived from non-human organisms, PEGylation or genetic engineering has been employed [258, 263, 264]. The stimulation of an immune response by immunotoxins has also been discussed as a potential benefit. There are data that suggest the development of anti-tumour immunity after treatment with immunotoxins. Anti-tumour immunity was hypothesised to be based on the ability of the immunotoxin to stimulate a strong immune activation [265]. Various mechanisms of resistance to immunotoxins have also been described, including mechanisms at the level of binding and internalisation, processing and trafficking and protein synthesis inhibition [266].

Regarding side effects, trichosanthin has been reported to be mostly well tolerated in patients with acquired immunodeficiency syndrome. However, compared with immunotoxins that are applied for cancer therapy, there are fewer clinical trials for RIPs in the context of antiviral therapy [222, 224].

4.3.4 Cancer-Targeting Immunotoxins

Toxin routes exemplify a concept that is useful as a therapeutic strategy for cancer treatment. The concept of delivering a toxic payload to a cell after specifically binding to a cellular receptor has been implemented in the form of immunotoxins that target cancer cells. Delivery has been adapted for this purpose by replacing the natural binding domain of the toxin by a binding moiety, which specifically binds to molecules that preferentially occur in cancer cells.

Cancer-targeting immunotoxins have advanced to clinical trials or have already been approved as a drug. They include immunotoxins based on P. aeruginosa exotoxin, Shiga toxin or diphtheria toxin [267,268,269,270]. An immunotoxin based on the cytokine interleukin-2 and on diphtheria toxin with the name denileukin diftitox has been approved in the USA for recurrent or persistent cutaneous T-cell lymphoma [271]. An immunotoxin that was approved for the treatment of relapsed or refractory hairy cell leukaemia is moxetumomab pasudotox (Lumoxiti; AstraZeneca AB, Cambridge, UK) [268]. Moxetumomab pasudotox is an anti-CD22 directed immunotoxin based on Pseudomonas exotoxin A [221, 268]. Cancer-targeting immunotoxins are reviewed more in depth elsewhere [221, 223, 270, 272,273,274,275].

5 Conclusions

Targeting the cytosol with macromolecules is difficult and toxins demonstrate one potential approach to how proteins can translocate to the cytosol from the extracellular space. Other methods to deliver macromolecules to the cytosol include strategies based on chemicals. In contrast to chemicals that disturb membrane barriers (like endosomal membranes) to allow cytosolic delivery of macromolecules, no membrane disruption is required if proteins are translocated from the ER to the cytosol via the ERAD pathway. Compared to many chemicals that are used for cytosolic delivery, using toxin routes could therefore avoid damage to the cell.

The type of molecules that are normally delivered to the cytosol via toxin routes is proteinaceous in nature. Cargoes that can be delivered via toxin routes might therefore be limited to molecules such as proteins or peptides with similar properties, potentially narrowing applications down to this class of molecules. Nucleic acids are not the type of cargo that normally travels via the toxin routes described here, different to commonly used chemicals for cytosolic delivery of macromolecules (e.g. lipid- or polymer-based reagents). Chemicals may therefore allow a slightly more versatile choice of cargoes, having been applied for both nucleic acid delivery and the direct delivery of proteins, although mainly applied for nucleic acid delivery [6, 145, 276]. However, nucleic acids have also already been described as a potential cargo when delivering via toxin routes [277, 278].

Potential effects of using toxin routes might include ER stress with UPR induction or immunogenicity of the bacteria- or plant-derived components. However, it might be application dependent whether such effects are disturbing or may even support the desired outcome, for example, if the aim is to kill cancer cells. In case immunogenicity is an unwanted effect, strategies for deimmunising toxin components by engineering or modification have been described. Furthermore, the induction of the UPR may be low if appropriate conditions are chosen [225, 226, 258, 263,264,265] or might not even apply depending on the entry mechanism of the toxin. The low quantitative efficiency of many delivery pathways via toxin routes is a potential limitation because only cargo molecules with high potency might be suitable for delivery via these routes. However, the development of RNA-based vaccines during the coronavirus disease 2019 pandemic as well as other RNA-based drugs have demonstrated how even delivery by routes that are expected to have low delivery efficiency can be sufficient for the desired therapeutic effect and for becoming approved as a drug [6, 131, 134, 135, 279].

Furthermore, every challenge for delivery of cargo via toxin routes can present a chance for therapy in the context of anti-toxin treatments and vice versa. Because a toxin often promiscuously binds to various host receptors, antitoxin strategies that aim at blocking toxin entry into cells can be challenging [11, 12, 19, 113, 174, 198, 199]. Therefore, toxin routes are promising targets for antitoxin treatments, as has been confirmed by antibodies that interfered with intracellular trafficking of toxins [19, 172, 174, 206, 207].

Finally, the development of therapeutics is already advanced in the field of immunotoxins. While antiviral immunotoxins have been explored and their application may have specific advantages concerning side effects over anti-cancer immunotoxins, the application of anti-cancer immunotoxins is so far most advanced, having resulted in approved drugs [221, 222, 268, 270, 273].