AAV-Cas9 is a gene-editing system that uses a harmless virus, called adeno-associated virus (AAV), to carry the molecular scissors of CRISPR-Cas9 directly into living cells. The AAV acts as the delivery truck, and the Cas9 enzyme plus a short guide RNA act as the payload, finding and cutting a specific stretch of DNA so researchers can disable a faulty gene, correct a mutation, or insert new genetic instructions. This combination has become one of the most widely studied approaches for in vivo gene therapy, with preclinical work targeting diseases of the muscle, liver, eye, and brain. But making it work well involves solving a cascade of practical problems, from fitting the editing machinery into a tiny viral shell to controlling how long the scissors stay active once inside the body.
Why Pair CRISPR With a Virus
CRISPR-Cas9 on its own is a set of molecules: a protein that cuts DNA and a short RNA guide that tells it where to cut. To edit cells inside a living person, you need a way to get those molecules into the right tissue. That is the delivery problem, and it is arguably harder than designing the edit itself. AAV has emerged as the go-to delivery vehicle for several reasons. It does not cause disease in humans. It can infect both dividing and non-dividing cells, which matters for tissues like the brain and heart where cells rarely replicate. And it persists in cells for months to years without integrating into the host genome under normal circumstances, meaning the editing instructions stick around long enough to do their job.
There are over a dozen natural AAV serotypes, each of which preferentially infects different tissues. AAV9, for instance, broadly distributes through the body after an intravenous injection, with strong expression in the liver and the ability to cross the blood-brain barrier. AAV8 favors the liver and skeletal muscle. AAV6 shows up in the heart, liver, and skeletal muscle. AAV4, somewhat surprisingly, accumulates heavily in lung and kidney tissue.1Molecular Therapy. Analysis of AAV Serotypes 1–9 Mediated Gene Expression and Tropism in Mice After Systemic Injection This natural tissue preference, called tropism, lets researchers choose a serotype that matches the organ they want to reach.
The Packaging Problem
AAV is a tiny virus, roughly 25 nanometers across, and its genome is small to match. The standard packaging capacity is about 4.7 kilobases (kb) of DNA. The gene for SpCas9, the most commonly used version of the CRISPR enzyme derived from the bacterium Streptococcus pyogenes, runs about 4.2 kb on its own. Once you add a promoter to drive expression, a guide RNA sequence, and regulatory elements, the total cassette easily exceeds what AAV can carry. This is the central engineering bottleneck of AAV-Cas9.
Researchers initially hoped AAV could stretch to accommodate slightly oversized genomes. Studies in the mid-2000s showed that AAV serotypes 1 through 5 could technically package recombinant genomes as large as 6.0 kb, but virions carrying those larger genomes were preferentially degraded inside cells.2PubMed Central. Packaging capacity of adeno-associated virus serotypes: impact of larger genomes on infectivity and postentry steps Later work using Southern blot analysis found that regardless of capsid type, packaged AAV genomes never exceeded about 5.2 kb in length, even when the DNA template was larger.3PubMed Central. Effect of genome size on AAV vector packaging More recent long-read sequencing has pinpointed the cliff: the proportion of full-length genomes drops sharply somewhere between 4.9 and 5.0 kb, mainly because the packaging machinery simply cannot finish loading longer sequences.4Molecular Therapy Methods & Clinical Development. Evaluation of the loading capacity and patterns of packaged DNA in AAV genomes of different sizes using long-read sequencing So while there is a little wiggle room beyond the textbook 4.7 kb, anything much past 5.0 kb produces mostly truncated, nonfunctional genomes.
Fitting the Scissors Into the Box
Given that size limit, the field has developed several strategies to make AAV-Cas9 work. The two most prominent are using smaller Cas9 enzymes and splitting the system across two AAV particles.
SaCas9, derived from Staphylococcus aureus, is roughly 1 kb shorter than SpCas9 and has comparable editing efficiency.5PubMed Central. Divergent susceptibilities to AAV-SaCas9-gRNA vector-mediated genome-editing in a single-cell-derived cell population That size reduction is enough to fit SaCas9 plus a guide RNA expression cassette into a single AAV vector. Researchers have even managed to pack SaCas9 alongside two guide RNAs in one AAV particle, which opens the door to strategies that make two cuts simultaneously to delete a stretch of DNA.6PubMed Central. Characterization of Staphylococcus aureus Cas9: a smaller Cas9 for all-in-one adeno-associated virus delivery and paired nickase applications Other compact Cas9 variants, such as Nme2Cas9 from Neisseria meningitidis, offer similar advantages and have been used in all-in-one AAV designs.
When a full-size SpCas9 is needed, or when the editing payload is too large even for a compact enzyme (as with base editors, which fuse Cas9 to additional protein domains), researchers turn to a dual-AAV split approach. The Cas9 protein is divided in half, and each half is fused to a piece of a naturally occurring protein-splicing element called a split intein. The two halves are packaged into separate AAV vectors. When both vectors infect the same cell, the intein halves find each other and chemically stitch the full Cas9 protein back together. This reconstituted enzyme has editing activity comparable to the intact version.7PubMed Central. Development of an intein-mediated split-Cas9 system for gene therapy The same intein-based splitting strategy is now standard for delivering base editors, which are too large for any single AAV vector.8Synthetic and Systems Biotechnology. Optimized dual-AAV base editor delivery system with enhanced editing efficiency and virion production titer
Beyond shrinking the enzyme, researchers have also been squeezing the regulatory elements. One recent effort systematically trimmed the promoters that drive guide RNA expression, finding that carefully truncated hybrid promoters retained full function at substantially shorter lengths, freeing up precious space within the AAV genome for other components.9PubMed Central. A Compact Promoter using a New Promoter Selection Strategy and Engineering Hybrid Pol II/III Enable Efficient Genome Editing in Human Retinal Ganglion Cells
Diseases Targeted in Preclinical Studies
The most advanced AAV-Cas9 work has focused on diseases caused by well-defined single-gene mutations where editing a manageable number of cells can produce a measurable clinical benefit. A few disease areas stand out.
Duchenne muscular dystrophy (DMD) results from mutations in the dystrophin gene, one of the largest human genes. Because the full gene is far too big to replace with AAV, researchers instead use CRISPR to snip out the mutated exons, producing a shorter but partially functional version of the protein. In mouse models of DMD, a dual-AAV system carrying Cas9 in one vector and the guide RNA in a self-complementary AAV format restored dystrophin expression and improved muscle function, with the self-complementary vector requiring at least twenty-fold lower doses than conventional single-stranded AAV for efficient editing.10PubMed Central. Enhanced CRISPR-Cas9 correction of Duchenne muscular dystrophy in mice by a self-complementary AAV delivery system
For liver-targeted editing, PCSK9 has become a popular proof-of-concept target. PCSK9 is a protein that raises LDL cholesterol by promoting the breakdown of LDL receptors. Disabling it with CRISPR could, in theory, permanently lower cholesterol without daily medication. In mice, an all-in-one AAV8 vector carrying SaCas9 and a PCSK9-targeting guide reduced circulating PCSK9 by about 80% and total cholesterol by roughly 35% over 24 weeks.11Molecular Therapy. In vivo PCSK9 gene editing using an all-in-one self-cleavage AAV-CRISPR system In nonhuman primates, AAV-delivered gene disruption of PCSK9 produced sustained reductions in both PCSK9 protein and LDL cholesterol that lasted through the study’s duration, with stable editing at the target gene.12Molecular Therapy. Long-term safety and durability of in vivo genome editing of PCSK9 in nonhuman primates
In the eye, AAV-CRISPR has been applied to Leber congenital amaurosis 10 (LCA10), a form of childhood blindness caused by a deep-intronic mutation in the CEP290 gene. A dual-AAV approach successfully deleted the mutation-containing intronic fragment in mouse retinas.13PubMed Central. CRISPR/Cas9-Mediated Genome Editing as a Therapeutic Approach for Leber Congenital Amaurosis 10 The eye is a particularly attractive organ for gene therapy because it is small (requiring low vector doses), partially immune-privileged, and easy to inject directly.
The Immune System Complication
A challenge that gets less public attention than off-target edits but may be equally important is the immune response. There are two layers to this problem.
The first is pre-existing immunity to AAV itself. Because AAV is a common environmental virus, many people already carry antibodies against it. These neutralizing antibodies can block the vector before it ever reaches the target tissue. Work on AAV6 showed that only relatively high levels of neutralizing activity fully inhibited the therapeutic protein from being produced, and that at moderate antibody levels, enough vector got through to maintain useful expression.14Gene Ther. Clinical enrollment assay to detect preexisting neutralizing antibodies to AAV6 with demonstrated transgene expression in gene therapy trials Still, patients with high anti-AAV titers are typically excluded from clinical trials, and re-dosing with the same AAV serotype is generally not feasible because the first dose triggers a strong antibody response.
The second layer is immunity to Cas9 itself. Both SpCas9 and SaCas9 come from bacteria that commonly infect humans, meaning many of us already have immune cells primed to recognize these proteins. One study found pre-existing T cell responses against SpCas9 in a large proportion of healthy adults.15Nature Medicine. High prevalence of Streptococcus pyogenes Cas9-reactive T cells within the adult human population For SaCas9, anti-SaCas9 T cells were detected in about 70% of Chinese donors tested, while antibodies were found in roughly 5%.16PubMed. Reduction of Pre-Existing Adaptive Immune Responses Against SaCas9 in Humans Using Epitope Mapping and Identification This means a patient’s immune system could attack cells expressing Cas9, potentially destroying them before the edit is complete or causing tissue inflammation. Strategies to address this include using Cas9 from bacteria that do not commonly infect humans, engineering Cas9 variants with fewer recognizable immune epitopes, or limiting how long Cas9 persists in the body.
AAV Integration at CRISPR Cut Sites
Under normal circumstances, AAV DNA mostly stays outside the host chromosome as loose circular molecules called episomes. This is one of its safety advantages over retroviruses, which integrate by design. But when AAV delivers CRISPR-Cas9, it introduces a complication: the Cas9 enzyme creates a double-strand break in the host DNA, and fragments of the AAV vector itself can get captured into that break as the cell tries to repair it.
Studies in mouse neurons, brain, muscle, and inner ear found AAV integration at Cas9-induced cut sites at rates as high as 47%.17PubMed Central. High levels of AAV vector integration into CRISPR-induced DNA breaks Follow-up work confirmed that vector integration was the single most common editing outcome at several target sites in both cultured neurons and in injected mouse brains, more common than the intended clean deletion or insertion.18Molecular Therapy. Single-target AAV-Cas9 vectors evaluate editing outcomes and AAV integration at Ube3a-ATS target sites Genome-wide mapping showed no increase in random AAV integration elsewhere, so the problem appears specific to where CRISPR cuts rather than being a general consequence of AAV infection. Still, having viral DNA lodged in the middle of a therapeutic gene is far from the intended outcome, and understanding the long-term consequences remains an open question.
Self-Inactivating Vectors
One way to reduce both off-target editing and the immunogenicity problem is to make the AAV-Cas9 system shut itself off after a window of activity. The idea is straightforward: include extra Cas9 target sites within the vector itself so that once Cas9 is expressed and performs its therapeutic edit, it eventually cuts its own DNA and destroys the instructions for making more of itself.
Several groups have built these self-inactivating (SIN) designs. One approach uses Nme2Cas9 in an all-in-one AAV vector where Cas9 target sites flanking the editing cassette allow the enzyme to chop the vector apart after editing. Anti-CRISPR proteins are used during manufacturing to prevent the vector from self-destructing before it reaches the patient’s cells.19PubMed Central. Self-inactivating, all-in-one AAV vectors for precision Cas9 genome editing via homology-directed repair in vivo In a mouse model of hereditary tyrosinemia, animals treated with the self-cleaving version of the vector ended up carrying significantly fewer AAV copies in their cells while still achieving around 4-5% precise correction of the disease gene, with no detectable off-target editing at predicted sites.20Nature Communications. Self-inactivating, all-in-one AAV vectors for precision Cas9 genome editing via homology-directed repair in vivo
A similar strategy was applied for Huntington’s disease, where a self-inactivating SaCas9 system was designed to target the mutant huntingtin gene and then abolish its own expression after a short burst of activity, maximizing editing while minimizing the window for off-target damage.21PubMed Central. Self-inactivating AAV-CRISPR at different ages enables sustained amelioration of Huntington’s disease deficits in BAC226Q mice
Engineered Capsids for the Brain
The central nervous system is one of the hardest tissues to reach with gene therapy because the blood-brain barrier blocks most molecules and viral particles from crossing into brain tissue. AAV9 is one of the few natural serotypes that can cross this barrier to some degree, but its efficiency is limited and it also heavily infects the liver at typical systemic doses. This has driven a wave of capsid engineering aimed at creating AAV variants with dramatically better brain penetration.
One engineered capsid, called BI-hTFR1, was designed to bind the human transferrin receptor, a protein abundantly expressed on the blood-brain barrier. In mice engineered to carry the human version of this receptor, BI-hTFR1 delivered 40 to 50 times more reporter gene expression in the brain compared to standard AAV9.22PubMed Central. An AAV capsid reprogrammed to bind human transferrin receptor mediates brain-wide gene delivery Another set of engineered variants, developed through a capsid-engineering platform tested in nonhuman primates, achieved brain transgene expression 600 to 2,000 times higher than AAV9 at the RNA level after intravenous injection, while simultaneously reducing liver exposure by 10- to 50-fold.23PubMed Central. Novel Engineered AAV Variants Demonstrate Superior Blood-Brain Barrier Penetration and Safety in Non-Human Primates That reduction in liver tropism matters enormously for safety, because liver toxicity has been one of the most serious adverse events in high-dose AAV gene therapy.
Dose-Related Toxicity at High AAV Levels
The liver toxicity issue deserves its own discussion because it has been one of the biggest real-world obstacles to clinical translation of AAV therapies broadly, not just AAV-Cas9. In nonhuman primates and piglets given a high intravenous dose of an AAV vector carrying the SMN gene (used for spinal muscular atrophy research), all three primates developed marked liver enzyme elevations. One of them developed acute liver failure and had to be euthanized four days after injection. The study also found degeneration of sensory neurons in the dorsal root ganglia, though the animals showed no outward sensory symptoms.24PubMed Central. Severe Toxicity in Nonhuman Primates and Piglets Following High-Dose Intravenous Administration of an Adeno-Associated Virus Vector Expressing Human SMN
Separate work comparing two preclinical species found that the toxic picture differs by animal model. In rats, high-dose AAV caused dose-dependent damage to dorsal root ganglia neurons but spared the liver. In cynomolgus monkeys, the same vector caused severe liver injury and coagulation problems at lower doses than expected, leading to early study termination and one death.25PubMed Central. Biodistribution and Tolerability of AAV-PHP.B-CBh-SMN1 in Wistar Han Rats and Cynomolgus Macaques Reveal Different Toxicologic Profiles These findings have pushed the field hard toward strategies that reduce the total dose needed, whether through engineered capsids that hit the target tissue more efficiently, local injection routes that bypass systemic circulation, or more potent expression cassettes that achieve the same therapeutic effect with less vector.
Hybrid Approaches and Alternatives to All-AAV Delivery
Not every part of the CRISPR system has to ride in an AAV. One increasingly popular strategy pairs AAV with lipid nanoparticles (LNPs), the same type of fat-based particles used in mRNA vaccines. In one approach, Cas9 is delivered as mRNA inside an LNP, which gives a short burst of protein expression that naturally fades as the mRNA degrades, while the guide RNA and a DNA repair template are delivered by AAV, which persists longer.26Nature Biotechnology. Therapeutic genome editing by combined viral and non-viral delivery of CRISPR system components in vivo This hybrid approach gets the best of both worlds: the tissue-targeting ability and DNA-template persistence of AAV, combined with the transient, self-limiting expression of LNP-delivered mRNA.
Compared to delivering Cas9 as DNA inside an AAV, mRNA delivery via LNPs reduced the theoretical risk of the vector’s DNA inserting into the host genome, triggered lower innate immune responses, and allowed researchers to fine-tune the dose more precisely.27PubMed. Biomembrane-inspired lipid nanoparticles enhance CRISPR-Cas9 editing for hemophilia A The trade-off is that LNPs currently home almost exclusively to the liver after systemic injection, so this hybrid strategy works best for liver-targeted edits. Reaching other organs with LNPs remains an active area of research.
Manufacturing Challenges
Even when a AAV-Cas9 therapy works beautifully in the lab, producing it at clinical scale is a formidable challenge. AAV manufacturing involves growing cells, transfecting them with the DNA constructs that encode the capsid and the therapeutic genome, harvesting the viral particles, and then purifying them to separate functional “full” capsids from “empty” ones that contain no DNA. Process variability, low yields, and difficulty scaling up remain major constraints on bringing these therapies to patients affordably. Recent improvements in purification, including affinity chromatography methods that work across different AAV serotypes and better ion-exchange techniques for separating full from empty particles, have helped, but the field broadly acknowledges that manufacturing is one of the most significant bottlenecks between promising preclinical results and accessible treatments.28PubMed Central. Advancing AAV vector manufacturing: challenges, innovations, and future directions for gene therapy Existing approved AAV gene therapies carry price tags in the hundreds of thousands to millions of dollars per dose, and manufacturing difficulty is a major reason why.