Comparative Evidence-Weighted In Silico Toxicity Profiling of the SARS-CoV-2 Main Protease Inhibitors Ensitrelvir and Nirmatrelvir

Abstract

Ensitrelvir and nirmatrelvir are the two most widely used oral SARS-CoV-2 main protease inhibitors, yet their toxicological profiles have never been compared under a single computational panel. An identical panel of 105 toxicity endpoints per compound was generated with ADMETlab 3.0, ProTox 3.0, Deep-PK, admetSAR 3.0 and Pred-hERG 5.0, yielding 210 endpoint-level predictions across 17 toxicological domains. Each endpoint formed a matched pair classified as shared positive, shared negative, discriminant or crossed, and predictions were compared against primary clinical and nonclinical literature under a three-level admissibility hierarchy that excluded prescribing information, regulatory review documents and commercial databases. Of 93 class-assignable pairs, 73 assigned both to the same class, 62 negative, and 20 differed. Four domains were shared positive: genotoxicity, with broad genotoxicity and micronucleus probabilities of 1.000 for both molecules, respiratory toxicity, nephrotoxicity and neurotoxicity; ototoxicity was high for both in a single tool. The largest separation was hepatic: ensitrelvir returned drug-induced liver injury 1.000 and human hepatotoxicity 0.994, against 0.314 and 0.456 for nirmatrelvir. Target class therefore does not determine predicted toxicological profile. Genotoxicity, respiratory, renal and neural endpoints are class-level validation priorities, whereas hepatic and hERG endpoints require compound-specific testing. These findings are hypothesis-generating prioritization markers, not confirmed toxicity.

1. Introduction

Direct-acting oral antivirals against SARS-CoV-2 occupy a distinctive position in therapeutic development because they are administered as short courses to large and heterogeneous outpatient populations. Those populations include individuals with renal or hepatic impairment and extensive concomitant medication, patients with mild disease who would never have progressed to severe illness, and, more recently, asymptomatic household contacts receiving post-exposure prophylaxis. The combination of broad exposure and brief administration means that the tolerability requirements are stricter than for therapies reserved for critically ill patients, and that early toxicological characterization matters primarily for directing subsequent experimental investigation rather than for confirming clinical safety.

Two orally administered inhibitors of the SARS-CoV-2 main protease, also designated Mpro, 3CL protease or nsp5, are now in clinical use, and they differ from one another in almost every structural respect while sharing a single molecular target. Nirmatrelvir is a peptidomimetic whose nitrile warhead occupies the enzyme active site and forms a reversible covalent adduct with the catalytic residue Cys145; enzymatic assays, mass spectrometry and crystallography established this mechanism, and comparison with appropriately positioned alkyne derivatives distinguished the reversible nitrile adduct from the more persistent adducts formed by alkyne analogues [1]. Ensitrelvir, developed as S-217622 and administered clinically as ensitrelvir fumaric acid, is a non-peptidic, non-covalent inhibitor whose triazinedione core carries three pharmacophoric elements: a 1-methyl-1,2,4-triazole directed to S1, a 2,4,5-trifluorobenzyl group occupying S2, and a 6-chloro-2-methylindazole directed to S1′ [2]. The non-covalent binding mode was resolved crystallographically and subsequently confirmed by an independent structural study of the enzyme and its variants [2,3]. Ensitrelvir therefore lacks the reactive electrophilic warhead present in nirmatrelvir and in many other covalent main protease inhibitors, which removes one classical structural liability but does not by itself define the toxicological profile of either compound.

A second asymmetry is pharmacological rather than structural. Nirmatrelvir is administered clinically together with ritonavir, which is a deliberate pharmacokinetic enhancer and not a structural component of the molecule. Dedicated interaction studies showed that the clinically prominent cytochrome P450 3A-mediated interactions of the combination are attributable predominantly to ritonavir, with midazolam exposure increasing approximately 14.3-fold in area under the curve and approximately 3.7-fold in maximum concentration under the combination and ritonavir alone producing a comparable effect [4]. Ensitrelvir is administered as a single agent. Any comparison between the two molecules must therefore be conducted at the level of the individual chemical entities, and regimen-level observations must not be attributed to nirmatrelvir alone.

The third asymmetry concerns the evidence available for comparison, and it is the most consequential for interpretation. A substantial part of the nonclinical safety package of nirmatrelvir has been published as primary experimental literature: Good Laboratory Practice safety pharmacology and repeat-dose toxicity studies in rats and monkeys have been reported in full [5], as have dedicated fertility, early embryonic development and embryo-foetal development studies in rats and rabbits [6], and a randomized pivotal trial provides primary evidence of short-course tolerability in high-risk non-hospitalized adults [7]. Human clinical pharmacology has likewise been characterized in primary reports covering the first-in-human programme [8] and renal impairment [9]. For ensitrelvir the situation is reversed. The clinical record is well documented, comprising a first-in-human study [10], a renal impairment study [11], and three phase 3 trials in treatment and in post-exposure prophylaxis [12,13,14], but no compound-specific hERG half-maximal inhibitory concentration, concentration-QTc analysis, bacterial reverse mutation report, micronucleus report, repeated-dose organ toxicity study, acute lethal dose determination or carcinogenicity study was identified as a verifiable primary source, and the nonclinical animal work available as primary literature was directed at antiviral efficacy and disease severity rather than at toxicology [15]. Ensitrelvir received U.S. Food and Drug Administration approval for post-exposure prophylaxis of COVID-19 in May 2026, and the corresponding prescribing information summarizes nonclinical safety data; however, because the evidence gate adopted in this study excludes regulatory documents, those summaries were not used as toxicological evidence and the asymmetry reported here describes the primary open-access literature rather than the totality of available information.

Orally administered main protease inhibitors beyond these two have reached clinical use, notably simnotrelvir, administered with ritonavir, and leritrelvir, developed for use without a pharmacokinetic enhancer, both approved in China [16,17]. The present comparison is restricted to ensitrelvir and nirmatrelvir for three reasons. First, these two molecules have the broadest regulatory uptake within the class, with nirmatrelvir authorized or approved across North America, Europe and Asia and ensitrelvir approved in Japan and, more recently, in the United States. Second, they have the most complete published primary evidence base, comprising first-in-human studies, dedicated clinical-pharmacology studies and phase 3 trials for both compounds, which the evidence-weighted design adopted here requires. Third, they provide the maximal structural contrast available within the class, a covalent peptidomimetic bearing a nitrile warhead against a non-covalent, non-peptidic triazinedione, so that signals shared by the two are more likely to reflect the target class or the behaviour of the prediction models than a shared scaffold. Extending the comparison to further main protease inhibitors is identified below as a limitation of the present design and as a future direction.

Computational toxicology can support the comparison of two compounds in these circumstances by screening many endpoints simultaneously under identical conditions and identifying findings that require closer experimental investigation. Available platforms cover hERG blockade, drug-induced liver injury, systemic and organ-specific toxicity, genotoxicity, carcinogenicity, nuclear receptor activity, cytotoxicity and environmental outcomes [18,19,20,21,22]. Comparison across tools is useful when the same domain is evaluated by more than one model, because agreement may strengthen the priority assigned to a finding while disagreement can indicate endpoints that require more targeted investigation. Applying an identical panel to two molecules that share a target adds a second axis to that comparison: a signal returned for both compounds is a candidate class-level or target-related property, or an artefact of the shared chemical space, whereas a signal returned for only one identifies a molecule-specific structural liability. Neither reading is available from a single-compound analysis.

This study therefore aimed to conduct a matched, evidence-weighted in silico toxicity comparison of ensitrelvir and nirmatrelvir, examining the two compounds under an identical endpoint panel, classifying every endpoint pair as shared or discriminant, integrating the computational outputs with the primary experimental evidence available for each molecule, and defining which validation priorities apply to the class and which apply to one compound only.

2. Methods

This study was conducted as a matched, evidence-weighted in silico toxicity comparison of ensitrelvir and nirmatrelvir. Computational predictions for the two compounds were generated under identical conditions and integrated with the primary clinical and nonclinical evidence available for each, in order to identify relevant toxicity domains, assess agreement among prediction tools, distinguish shared from compound-specific signals, and define gaps requiring further investigation. The analysis was not designed to establish clinical safety, to confirm organ toxicity, to rank the two products for clinical use, or to replace experimental toxicology.

Compound identity was curated from the study dataset for both molecules, and both molecular inputs were verified before use rather than adopted from a chemical database or a commercial supplier. For ensitrelvir the following SMILES string of the free base was used as the molecular input for all five platforms:

CN1C=NC(CN2C(=O)NC(=NC3=CC4=CN(C)N=C4C=C3Cl)N(CC3=CC(F)=C(F)C=C3F)C2=O)=N1

The standard InChIKey recomputed from this string was QMPBBNUOBOFBFS-UHFFFAOYSA-N, matching the reference identifier of ensitrelvir in the skeleton, stereochemical and protonation blocks; the derived molecular formula was C₂₂H₁₇ClF₃N₉O₂ with a monoisotopic mass of 531.1146 Da; the structure resolved to a single fragment, confirming that the free base and not a salt form was submitted; and the three pharmacophoric elements were each confirmed present by substructure matching, namely the 1-methyl-1H-1,2,4-triazole attached through a methylene to a ring nitrogen, the 2,4,5-trifluorobenzyl group borne by a second ring nitrogen, and the chlorinated 2-methyl-2H-indazole, together with the six-membered three-nitrogen triazinedione core carrying two ring carbonyls and one exocyclic carbon–nitrogen double bond. The molecule contains no stereogenic centre, which the UHFFFAOYSA stereochemical block of the identifier independently confirms, so no configurational assignment was required or possible. One qualification applies to the exocyclic carbon–nitrogen double bond of the core: it belongs to a mobile-hydrogen system, and the imino form drawn in the string above and the corresponding amino tautomer return the same standard InChI because the mobile-hydrogen layer subsumes both, so the tautomer chosen for the input does not alter the compound identity carried into the predictions. The fumaric acid salt employed in the clinical product was not modelled separately, because the predictive platforms operate on the neutral parent structure; this distinction is relevant to solubility and formulation rather than to the structural basis of the toxicity predictions.

For nirmatrelvir the following isomeric SMILES string was used as the molecular input for all five platforms:

[H][C@]12CN([C@H](C(=O)N[C@@H](C[C@]3([H])CCNC3=O)C#N)[C@@]1([H])C2(C)C)C(=O)[C@@H](NC(=O)C(F)(F)F)C(C)(C)C

The standard InChIKey recomputed from this string was LIENCHBZNNMNKG-OJFNHCPVSA-N, matching the reference identifier of nirmatrelvir in the skeleton, stereochemical and protonation blocks; the derived molecular formula was C₂₃H₃₂F₃N₅O₄ with a monoisotopic mass of 499.2406 Da; all six stereogenic centres carried explicit configurational assignments, with no undefined centre; and the nitrile warhead, the trifluoroacetamide group, the glutamine-derived γ-lactam and the 6,6-dimethyl-3-azabicyclo [3.1.0], hexane core were each confirmed present by substructure matching. This verification matters for a covalent inhibitor, because an input with an undefined or inverted stereocentre would propagate silently through every endpoint of the panel. The contrast between the stereochemical blocks of the two identifiers, UHFFFAOYSA against OJFNHCPVSA, is a compact statement of the structural difference between the two inputs: an achiral, planar-dominated scaffold on one side and a six-stereocentre peptidomimetic on the other. Because ritonavir is a co-administered pharmacokinetic enhancer and not a structural component of nirmatrelvir, all predictions and all interpretations refer to each antiviral as a single chemical entity [4].

The structural dissimilarity between the two verified inputs was quantified using the Tanimoto coefficient, which was 0.076 for Morgan fingerprints (radius 2, 2048 bits) and 0.494 for MACCS keys, confirming that the two molecules occupy distant regions of chemical space and that any shared prediction cannot be attributed to overall scaffold similarity.

Endpoint-level toxicity predictions were generated using ADMETlab 3.0 [18], ProTox 3.0 [19], Deep-PK [20], admetSAR 3.0 [21] and Pred-hERG 5.0 [22]. The platforms were selected according to their toxicity coverage, model-development procedures, reported performance, and availability of validation data. Table 1 summarizes the algorithmic basis, training data, reported performance and main limitations of each platform. All platforms were accessed between. ADMETlab 3.0 includes 36 toxicity properties and eight toxicophore rules among its 119 features. Its 77 predictive models comprise 59 classification and 18 regression models developed with training, validation and test sets divided at an 8:1:1 ratio. Across the classification models, area under the receiver operating characteristic curve values ranged from 0.72 to 0.99 for 40 existing endpoints and from 0.73 to 0.96 for 20 newly introduced endpoints. For regression models, coefficient of determination values for most of the 13 existing endpoints ranged from 0.75 to 0.95, while four of the five newly added regression endpoints achieved values between 0.80 and 0.90 [18]. ProTox 3.0 provides 61 models covering acute toxicity, organ toxicity, general toxicological outcomes, adverse-outcome pathways, molecular initiating events and toxicity-associated targets. The 28 newly developed models underwent tenfold cross-validation and evaluation using independent external sets. For the organ-toxicity models relevant to this study, external-validation area under the curve values ranged from 0.89 to 0.95, with accuracies from 78.0% to 89.0%. The respiratory-toxicity model achieved an external area under the curve of 0.93 and an accuracy of 88.9%, while the neurotoxicity, nephrotoxicity and cardiotoxicity models reached values of 0.91, 0.89 and 0.95, respectively [19]. Deep-PK comprises 73 predictive tasks, including 35 toxicity assays, and uses 49 classification and 24 regression models based on a directed message-passing neural network. Model optimization and performance assessment used threefold cross-validation, with the Matthews correlation coefficient applied to classification and the coefficient of determination to regression; in addition, the platform provides confidence indicators based on prediction probabilities and the 95% ranges of molecular weight and training labels [20], and admetSAR 3.0 provides 119 endpoints, including 43 human-health toxicity, 16 ecological-risk and nine cosmetic-risk endpoints, supported by more than 370,000 experimental records for 104,652 compounds. Its CLMGraph models underwent fivefold cross-validation and external validation; across 90 classification models the mean area under the curve was 0.870, while more than 82% of the regression models achieved Pearson correlation coefficients above 0.70, accompanied by low mean absolute error and root-mean-square error values [21]. Pred-hERG 5.0 was used as the specialized hERG tool and provides binary classification, multiclass classification and pIC50 regression based on curated ChEMBL v30 data. The models were developed using fivefold cross-validation, applicability-domain assessment and Y-randomization. On an independent external set, the binary model achieved a balanced accuracy of 0.82, a Matthews correlation coefficient of 0.65 and an area under the curve of 0.82, while the regression model reached a coefficient of determination of 0.66 and a root-mean-square error of 0.45. Pred-hERG 5.0 also combines the three models into a consensus output and provides fragment-contribution maps and interpretation based on Shapley additive explanations [22]. These statistics are the platform-level figures published by the developers of each tool and were used to assess platform-level reliability and to support endpoint selection and interpretation. Where a platform additionally returns an endpoint-specific performance figure, that figure is recorded separately in Supplementary Table S1 and may differ from the published platform-level value; neither was treated as compound-specific validation for either molecule.

Table 1. Summary of the computational platforms used for endpoint-level toxicity prediction.

Platform	Algorithm and Model Type	Endpoints Used in This Study (n)	Training Data and Validation	Reported Performance	Main Characteristics and Limitations
ADMETlab 3.0 [18]	Multi-task directed message-passing neural network (DMPNN, Chemprop) combined with RDKit 2D descriptors; 59 classification and 18 regression models	36	More than 400,000 curated entries across 119 endpoints; training/validation/test split 8:1:1	AUC 0.72–0.99 (40 existing) and 0.73–0.96 (20 new) classification endpoints; R2 0.75–0.95 for most regression endpoints	Platform-level metrics only; no uniform per-endpoint applicability domain; probability outputs require banding for cross-platform comparison
ProTox 3.0 [19]	Molecular similarity, pharmacophore- and fragment-propensity models combined with machine-learning classifiers (random forest for organ toxicity); 61 models	37	Curated in vitro and in vivo toxicity data; tenfold cross-validation plus independent external sets (28 new models)	External AUC 0.89–0.95 and accuracy 78.0–89.0% for the organ-toxicity models used here	Returns a class with a confidence score rather than a calibrated probability; confidence scores are not directly comparable with the probability outputs of other platforms
Deep-PK [20]	Directed message-passing neural network (D-MPNN); 49 classification and 24 regression models across 73 tasks	30	Curated assay collections covering 35 toxicity tasks; threefold cross-validation	Per-task MCC (classification) and R2 (regression); confidence indicators from prediction probabilities and training-label ranges	Some endpoint training sets are very small; two outputs in this study carried internally inconsistent values and were excluded from prioritization
admetSAR 3.0 [21]	CLMGraph, a multi-task graph neural network with contrastive-learning pre-training	1	More than 370,000 experimental records for 104,652 compounds; fivefold cross-validation plus external validation	Mean AUC 0.870 across 90 classification models; more than 82% of regression models with Pearson r > 0.70	The single endpoint used here (bacterial mutagenicity) was returned with a reported total set of zero records and was treated as non-interpretable
Pred-hERG 5.0 [22]	QSAR binary and multiclass classification and pIC50 regression with SHAP-based interpretation and fragment-contribution maps	1	Curated ChEMBL v30 hERG data (14,364 compounds); fivefold cross-validation, applicability-domain assessment and Y-randomization	External balanced accuracy 0.82, MCC 0.65 and AUC 0.82 (binary); R2 0.61 and RMSE 0.48 (regression)	Single-target tool; regression output on the pIC50 scale is not banded under the probability thresholds used for the other platforms

For each endpoint and each compound, the prediction tool, numerical value, qualitative class, probability or score, dataset size and reported model-performance metrics were extracted when available. Missing values were retained as missing, while unreported versions, thresholds, algorithm settings, unit transformations and applicability-domain assignments were not reconstructed. Outputs were compiled into a single master table and organized into seventeen domains: systemic toxicity; hERG-related cardiotoxicity; hepatotoxicity and drug-induced liver injury; nephrotoxicity; respiratory toxicity; neurotoxicity; ototoxicity; genotoxicity; carcinogenicity; cellular toxicity; stress-response and mitochondrial endpoints; immunotoxicity; hematotoxicity; endocrine-related toxicity; toxicity-associated targets; local tolerance; and environmental toxicity. Because the reporting conventions of the platforms differ, outputs were normalized before comparison: ADMETlab 3.0 and admetSAR 3.0 values were read as the probability of the positive or toxic category, Deep-PK outputs were read as a class assignment accompanied by its probability, and ProTox 3.0 outputs were read as a class assignment accompanied by a confidence score, so that a high ProTox 3.0 numerical value attached to an inactive class denotes a confident negative rather than a positive signal.

The comparison was conducted pairwise at endpoint level. Because the same panel was applied to both molecules, every toxicity endpoint yielded one ensitrelvir output and one nirmatrelvir output produced by the same model under the same conventions, so that differences between the two values cannot be attributed to differences in model choice, version or threshold. For endpoints returning a class, the two outputs were compared directly. For endpoints returning a probability on the ADMETlab 3.0 or admetSAR 3.0 scale, values were banded according to the interpretation ranges documented by those platforms, with values below 0.3 read as low, values between 0.3 and 0.7 read as intermediate and values of 0.7 or above read as high. Each matched pair was then assigned to one of five categories: shared positive, when both compounds fell in the positive or high band; shared negative, when both fell in the negative or low band; discriminant with ensitrelvir higher; discriminant with nirmatrelvir higher; or crossed, when the tools evaluating the same endpoint placed the two compounds in opposite directions relative to each other. Regression endpoints reported on platform-internal scales without a stated unit or transformation were examined descriptively and were not banded. Domain-level classification followed the pattern of the endpoints within each domain rather than any single output.

First, each output was recorded exactly as returned, together with the qualitative class where the platform provides one. Second, probability outputs were banded using the platform-documented thresholds described above, placing class-based and probability-based outputs on a common three-level scale. Third, each matched pair was assigned to one of the five categories defined above: shared positive and shared negative require both compounds in the same outer band; a pair is discriminant when the two compounds fall in different bands with a consistent direction across the tools evaluating that endpoint; and a pair is crossed when the tools evaluating the same endpoint place the two compounds in opposite directions relative to each other, so that no consistent inter-compound direction exists. Fourth, domain-level statements were required to reflect the pattern of all endpoints within the domain rather than any single output. Robustness was assessed by cross-tool reproducibility, quantified for every endpoint evaluated by more than one platform as the degree to which all tools placed a given compound in the same band, and by a reliability screen in which endpoints produced by models with a reported Matthews correlation coefficient below 0.45, or a coefficient of determination below 0.50 for regression outputs, were flagged and excluded from prioritization. The procedure is deterministic and fully reproducible from Supplementary Table S1, which records every value, class, band assignment and flag used in the analysis.

Duplicate and overlapping endpoints were retained because agreement and disagreement between tools were relevant to the analysis. Related predictions were categorized as convergent, partially convergent, divergent or heterogeneous within each compound before the two compounds were compared with each other. Both positive and negative results were preserved to avoid selective reporting. Model-performance statistics were used to describe the reported behaviour of each model and were not treated as confirmation of prediction accuracy for either compound. Endpoint prioritization considered toxicological relevance, tool agreement, strength of the numerical output, magnitude and direction of the difference between compounds, biological plausibility, and availability of external comparators. Broad systemic endpoints and isolated or discordant predictions received secondary or exploratory status when they lacked support from other tools or from external evidence. Outputs whose reported numerical value or dataset size was internally inconsistent were classified as non-interpretable and were excluded from prioritization while remaining visible in the dataset. Separately, and independently of whether an endpoint supported a prioritized finding, every output was screened against a fixed reliability floor of a reported Matthews correlation coefficient below 0.45 or a reported coefficient of determination below 0.50, and outputs falling below it were flagged as being of low reported reliability. This screen is deliberately blind to the importance of the endpoint, so that flags fall on central and peripheral outputs alike. Both flags, together with flags for platform threshold conventions and for endpoints whose name does not describe what the model measures, are recorded row by row in Supplementary Table S1. Because ProTox 3.0 reports only area under the curve, the reliability floor could not be evaluated for its outputs, which is a limitation of the reported metrics rather than an indication that those models are more reliable.

A targeted literature search was conducted for both compounds, covering pharmacology, mechanism of action, safety pharmacology, repeat-dose toxicity, reproductive and developmental toxicity, genotoxicity, carcinogenicity, organ-specific toxicity, cellular toxicity, haematological and immune effects, cardiac electrophysiology, clinical safety and clinical pharmacology including special populations. Primary experimental studies, clinical trials with published results and nonclinical reports with verifiable full text were prioritized. Prescribing information, regulatory review documents, monographs, professional news, commercial databases, vendor and compound-database pages, patient-oriented websites and press releases were not considered primary evidence and were not used as sources of toxicological information. Statements traceable only to such documents were recorded as evidence gaps rather than as toxicological evidence, and no numerical value obtained exclusively from them was carried into the manuscript. This conservative inclusion criterion is deliberately conservative and has a direct analytical consequence that is reported transparently throughout: several widely reported nonclinical results are held outside the primary open access literature admitted here, so their classification as domains without an admissible primary comparator describes the auditable record rather than the totality of what is known.

Candidate statements were reviewed according to source origin, evidence type, directness of support, agreement among models, consistency with external evidence and risk of overinterpretation. Computational and experimental evidence was categorized as concordant, partially concordant, divergent or lacking an admissible primary comparator, and a further category was reserved for toxicological domains in which primary experimental evidence exists for at least one compound but no corresponding computational endpoint is available in the panel. Animal findings were never converted into clinical statements, no-observed-adverse-effect levels were kept distinct from any observed non-adverse effect, and the absence of a study was never encoded as a negative result. Predictions were not used to determine dose–response relationships, incidence, severity, patient-level risk, comparative clinical safety or regulatory acceptability. The study used only computational predictions and publicly available primary scientific literature, and no patient-level or otherwise identifiable data were used; formal approval from an institutional review board or ethics committee was therefore not required.

The analytical framework adopted here is consistent with previous studies that combined multiple in silico platforms to examine organ-specific and other toxicity endpoints, compare predictions across computational tools, and integrate the findings with available experimental, clinical or contextual evidence [23,24,25,26,27].

3. Results

3.1. Overview of the Panel and Pairwise Classification

The panel produced 105 toxicity endpoint-level predictions per compound and therefore 210 predictions in total, distributed identically between the two molecules: 37 outputs from ProTox 3.0, 36 from ADMETlab 3.0, 30 from Deep-PK, one from Pred-hERG 5.0 and one from admetSAR 3.0. The complete master table for each compound, which also covers absorption, distribution, metabolism and excretion endpoints outside the scope of this analysis, contains 168 entries. Every endpoint was therefore available as a matched pair, and no endpoint had to be excluded because it was evaluated for one compound and not the other.

Because several endpoints were evaluated by more than one platform, the 105 endpoint-level predictions per compound do not represent 105 independent pieces of evidence. The underlying models share overlapping training data and descriptor spaces, and related endpoints within a domain are correlated by construction. To avoid treating redundancy as replication, endpoints were grouped into 66 unique toxicological endpoints, of which 21 were evaluated by more than one platform and could be assessed for cross-tool concordance, 37 were single-tool class-assignable endpoints, and eight were regression outputs examined descriptively. Across the 21 multi-tool endpoints, corresponding to 42 compound-level assessments, 30 (71%) were fully convergent, with every tool placing the compound in the same band, four were partially convergent, and eight were divergent. Divergence was concentrated in three areas: the AMES mutagenicity endpoint, divergent for both compounds across three platforms; the hepatic domain, in which drug-induced liver injury was convergent for ensitrelvir but divergent for nirmatrelvir and human hepatotoxicity was divergent for both; and organ-level nephrotoxicity, divergent for both compounds.

Of the 105 matched pairs, 12 were regression outputs reported on platform-internal scales and were examined descriptively. Among the remaining 93 class-assignable pairs, 73 placed both compounds in the same category, of which 62 were negative and 11 were positive, and 20 placed the two compounds in different categories; of those 20, 14 assigned the higher output to ensitrelvir and six to nirmatrelvir. The predicted toxicological profiles of the two molecules are therefore dominated by shared negative outputs, with a small set of shared positive signals and a well-defined group of discriminant endpoints concentrated in a few domains. Table 2 presents the prioritized endpoint-level predictions for both compounds with their inter-compound classification, Figure 1 integrates each domain with the computational signal of each molecule and the availability of a primary experimental comparator, and Figure 2 organizes the domains into shared, compound-specific and deprioritized validation tiers.

Table 2. Prioritized endpoint-level in silico toxicity predictions for ensitrelvir and nirmatrelvir under an identical panel.

Domain	Endpoint	Tool	Ensitrelvir Value/Class	Nirmatrelvir Value/Class	Inter-Compound Relationship	Interpretation Caveat
Genotoxicity	Genotoxicity	ADMETlab 3.0	1.000	1.000	Shared positive	Maximal output for both; broad endpoint, not equivalent to confirmed genotoxicity.
Genotoxicity	Micronucleus	Deep-PK	Toxic (1.000)	Toxic (1.000)	Shared positive	Maximal output for both; requires experimental micronucleus testing.
Genotoxicity	Ames mutagenicity	ADMETlab 3.0	0.940	0.559	Ensitrelvir higher	Borderline for nirmatrelvir; not supported by the other two Ames models in either compound.
Genotoxicity	Ames mutagenicity	Deep-PK	Safe (0.134)	Toxic (0.951)	Nirmatrelvir higher	Reverses the ADMETlab 3.0 ordering; preserves discordance in bacterial mutagenicity.
Genotoxicity	Ames mutagenicity	admetSAR 3.0	0.371	0.054	Ensitrelvir higher	Both below the positive band; reported dataset size unavailable for both.
Genotoxicity	Mutagenicity	ProTox 3.0	Active (0.57)	Inactive (0.57)	Ensitrelvir higher	Identical confidence with opposite class; among the lower confidences of the ProTox 3.0 panel.
Genotoxicity	SR-p53; SR-ATAD5	ADMETlab 3.0; ProTox 3.0; Deep-PK	Low/inactive/safe	Low/inactive/safe	Shared negative	DNA-damage-response markers do not support the broad signal in either compound.
Respiratory toxicity	Respiratory toxicity	ADMETlab 3.0	0.689	0.988	Nirmatrelvir higher	Highest organ-level output of the nirmatrelvir dataset; moderate magnitude for ensitrelvir.
Respiratory toxicity	Respiratory toxicity	ProTox 3.0	Active (0.83)	Active (0.70)	Shared positive	Screening-level endpoint; does not define a clinical respiratory phenotype.
Respiratory toxicity	Respiratory toxicity	Deep-PK	Toxic (0.995)	Toxic (0.809)	Shared positive	Convergent across three tools for both compounds; the models carry no exposure dimension.
Nephrotoxicity	Drug-induced nephrotoxicity	ADMETlab 3.0	0.993	0.938	Shared positive	Must be separated from renal-impairment pharmacokinetics in both compounds.
Nephrotoxicity	Drug-induced nephrotoxicity	ProTox 3.0	Inactive (0.58)	Inactive (0.60)	Shared negative	Model disagreement within each compound prevents strong inference.
Hepatotoxicity/DILI	Drug-induced liver injury	ADMETlab 3.0	1.000	0.314	Ensitrelvir higher	Largest hepatic separation; maximum output does not establish clinical liver injury.
Hepatotoxicity/DILI	Human hepatotoxicity	ADMETlab 3.0	0.994	0.456	Ensitrelvir higher	Prioritization marker for ensitrelvir; nirmatrelvir value lies close to the decision boundary.
Hepatotoxicity/DILI	Drug-induced liver injury	Deep-PK	Toxic (0.693)	Safe (0.222)	Ensitrelvir higher	Low reported MCC (0.37) for this model in both compounds.
Hepatotoxicity/DILI	Human hepatotoxicity	ProTox 3.0	Inactive (0.55)	Inactive (0.87)	Shared negative	Same class at markedly different confidence; 0.55 is the lowest of its organ-toxicity panel for ensitrelvir.
hERG/cardiotoxicity	hERG blocker (pIC50)	Pred-hERG 5.0	Moderate blocker (5.394)	Non-blocker (4.953)	Ensitrelvir higher	Predicted values, not experimental IC50; 4.953 lies in the platform’s 4.5–5 weak-blocker band.
hERG/cardiotoxicity	hERG blockers	ADMETlab 3.0	0.172	0.029	Shared negative	Both below threshold; produced by the hERG model with the highest reported AUC (0.937).
hERG/cardiotoxicity	hERG blockers at 10 µM	ADMETlab 3.0	0.389	0.095	Ensitrelvir higher	Ensitrelvir below the decision threshold but intermediate; moderate reported MCC.
hERG/cardiotoxicity	Broad cardiotoxicity	ProTox 3.0	Inactive (0.86)	Inactive (0.83)	Shared negative	Prevents generalization to global cardiotoxicity for either compound.
Neurotoxicity	Drug-induced neurotoxicity	ADMETlab 3.0	0.999	0.898	Shared positive	Broad endpoint; no neurological pathway assigned in either compound.
Neurotoxicity	Drug-induced neurotoxicity	ProTox 3.0	Active (0.89)	Active (0.61)	Shared positive	Screening-level prioritization signal.
Neurotoxicity	Neural target panel (AChE, RYR, GABAR, NMDAR, AMPAR, KAR, VGSC)	ProTox 3.0	All inactive	All inactive	Shared negative	No target-level output supports the broad signal in either compound.
Neurotoxicity	Blood–brain barrier penetration	ADMETlab 3.0	0.004	0.000	Shared negative	Penetration, not barrier toxicity; the two BBB endpoints are related but not equivalent.
Neurotoxicity	Blood–brain barrier toxicity	ProTox 3.0	Active (0.85)	Inactive (0.52)	Ensitrelvir higher	Barrier toxicity endpoint; 0.52 is among the lowest ProTox 3.0 confidences for nirmatrelvir.
Ototoxicity	Ototoxicity	ADMETlab 3.0	0.968	0.827	Shared positive	Single-tool signal for both; no comparator model in the panel.
Carcinogenicity	Carcinogenicity	ADMETlab 3.0	0.926	0.180	Ensitrelvir higher	Second largest separation of the comparison, from the weakest-performing model of the panel.
Carcinogenicity	Carcinogenicity	ProTox 3.0	Inactive (0.58)	Inactive (0.60)	Shared negative	Does not support a convergent carcinogenicity signal in either compound.
Carcinogenicity	Carcinogenicity	Deep-PK	Safe (0.308)	Safe (0.177)	Shared negative	Tool output, not a clinical safety conclusion.
Cellular toxicity	HEK293 cytotoxicity	ADMETlab 3.0	0.847	0.130	Ensitrelvir higher	Only positive cellular output in the comparison; the sole renal-derived line in the panel.
Cellular toxicity	A549 cytotoxicity	ADMETlab 3.0	0.080	0.032	Shared negative	Airway-derived line negative for both despite the convergent respiratory flag.
Cellular toxicity	Broad cytotoxicity	ProTox 3.0	Inactive (0.60)	Inactive (0.67)	Shared negative	Prevents a broad cytotoxicity conclusion in either direction.
Hematotoxicity	Hematotoxicity	ADMETlab 3.0	0.618	0.170	Ensitrelvir higher	Single-tool endpoint for both; classifiers of this type do not encode coagulation-pathway effects.
Immunotoxicity	Immunotoxicity	ProTox 3.0	Active (0.92)	Inactive (0.63)	Ensitrelvir higher	Does not establish immunotoxicity; contradicted by the cell-specific output for ensitrelvir.
Immunotoxicity	RPMI-8226 immunotoxicity	ADMETlab 3.0	0.056	0.035	Shared negative	Low cell-specific output for both compounds.
Systemic toxicity	Rat oral acute toxicity	ADMETlab 3.0	0.488	0.915	Nirmatrelvir higher	Ensitrelvir adjacent to the classification threshold; nirmatrelvir value discordant with primary rodent data.
Systemic toxicity	FDA maximum recommended daily dose	ADMETlab 3.0	0.845	0.863	Shared positive	Dose-related surrogate, not organ toxicity; nearly identical despite different clinical dose levels.
Systemic toxicity	Rat acute LD50; chronic oral LOAEL; MTD	Deep-PK	2.69; 1.25; 0.47	3.28; 1.46; −0.01	Different systemic measures	Reported without stated unit or transformation; the platform labels MTD values at or below 0.477 as non-toxic.
Systemic toxicity	Broad clinical toxicity	ProTox 3.0	Active (0.57)	Active (0.63)	Shared positive	Broad, non-specific endpoint at low confidence in both compounds.
Stress response	SR-ARE	ADMETlab 3.0; ProTox 3.0; Deep-PK	0.048; inactive (0.95); toxic (0.626)	0.942; inactive (0.93); safe (0.115)	Crossed	The two disagreeing platforms place the compounds in opposite orders; no direction assignable.
Mitochondrial stress	SR-MMP	ADMETlab 3.0; ProTox 3.0; Deep-PK	0.000; inactive (0.83); safe (0.143)	0.045; inactive (0.86); safe (0.003)	Shared negative	Consistent negative across three tools and both compounds.
Endocrine toxicity	Nuclear receptor and thyroid-related panel	ADMETlab 3.0; ProTox 3.0; Deep-PK	Low/inactive/safe	Low/inactive/safe	Shared negative	Applies only to the targets directly examined; no prolactin or hypothalamic-pituitary endpoint available.
Toxicity-associated targets	PXR	ProTox 3.0	Inactive (0.63)	Active (0.66)	Nirmatrelvir higher	Only target changing class between compounds; principal transcriptional regulator of CYP3A.
Toxicity-associated targets	CAR; NADH oxidase; NIS	ProTox 3.0	Inactive	Inactive	Shared negative	Constrains target-level mechanistic hypotheses for both compounds.
Local tolerance	Eye corrosion; eye irritation	ADMETlab 3.0; Deep-PK	0.000; 0.002/safe	0.000; 0.083/safe	Shared negative	Produced by the highest-performing models of the panel (AUC 0.996 and 0.973).
Local tolerance	Skin sensitization	ADMETlab 3.0; Deep-PK	0.020/safe (0.309)	0.586/safe (0.450)	Nirmatrelvir higher	Borderline in one tool only; limited relevance for orally administered compounds.
Environmental toxicity	Ecotoxicity; bee toxicity; avian toxicity	ProTox 3.0; Deep-PK	Inactive (0.50); toxic (0.54); safe (0.043)	Inactive (0.52); toxic (0.939); safe (0.016)	Partially shared	Borderline ecotoxicity confidence in both; bee toxicity threshold definition is ambiguous.

Figure 1. Comparative computational-evidence concordance map for ensitrelvir and nirmatrelvir. Each row names a toxicity domain together with the endpoint that represents it, and reports the output obtained for that endpoint in each compound under the identical 105-endpoint panel. The map then classifies the relationship between the two profiles as shared positive, shared negative, discriminant in favour of one compound, or crossed; marks whether a primary experimental comparator was identified; and assigns a joint validation priority. Genotoxicity, respiratory toxicity and nephrotoxicity are shared high-priority domains, whereas hepatotoxicity and hERG-related electrophysiology separate the two molecules while also carrying high priority. A primary experimental comparator was identified for nirmatrelvir in eight of the domains shown and for ensitrelvir in none. The complete endpoint-level dataset underlying each row is given in Table 1 and Supplementary Table S1.

Figure 2. Joint toxicity domain prioritization map for ensitrelvir and nirmatrelvir. Domains are organized as shared validation priorities, ensitrelvir-specific priorities, nirmatrelvir-specific priorities, or deprioritized and not covered by the computational panel, according to the direction and magnitude of the difference between the two compounds, the degree of agreement across tools within each compound, and the availability of a primary experimental comparator. Reproductive and developmental toxicity and coagulation and haemostasis are shown as the inverse case, in which primary experimental evidence exists for at least one compound but no computational endpoint is present in the panel.

3.2. Genotoxicity

Genotoxicity contained the strongest mutually supportive outputs in both datasets and, uniquely among the domains, produced identical maximal values for the two compounds. ADMETlab 3.0 returned a broad genotoxicity value of 1.000 for ensitrelvir and 1.000 for nirmatrelvir, produced by the highest-performing classification model among the prioritized endpoints of the panel, with a reported area under the curve of 0.961 and a Matthews correlation coefficient of 0.774, and Deep-PK returned a toxic micronucleus prediction with a probability of 1.000 for both compounds, with a reported Matthews correlation coefficient of 0.80. These were the only outputs reaching 1.000 for nirmatrelvir and two of only three such outputs for ensitrelvir.

Bacterial mutagenicity behaved in the opposite manner and was discordant for both molecules, but in mirror-image directions. For ensitrelvir, ADMETlab 3.0 returned an Ames value of 0.940 while Deep-PK classified the compound as safe with a probability of 0.134 and admetSAR 3.0 returned 0.371. For nirmatrelvir, ADMETlab 3.0 returned 0.559, Deep-PK classified the compound as toxic with a probability of 0.951, and admetSAR 3.0 returned 0.054. The two models that disagreed most sharply therefore reversed their relative positions between the compounds, with the three platforms evaluating this single assay spanning almost the entire probability range for nirmatrelvir and a wide range for ensitrelvir. ProTox 3.0 classified mutagenicity as active for ensitrelvir and inactive for nirmatrelvir, in both cases with a confidence score of 0.57, one of the lower confidence values recorded in its panel.

Stress-response endpoints associated with DNA damage did not follow the broad genotoxicity signal for either compound. SR-p53 was 0.001 for ensitrelvir and 0.167 for nirmatrelvir in ADMETlab 3.0, inactive in ProTox 3.0 for both, and safe in Deep-PK for both; SR-ATAD5 was 0.000 and 0.051, respectively, and inactive or safe across the other two tools.

3.3. Respiratory Toxicity

Respiratory toxicity showed the clearest agreement among the organ-specific endpoints for both compounds and was positive across three platforms in each case. For ensitrelvir, Deep-PK returned a toxic prediction with a probability of 0.995, ProTox 3.0 indicated an active class with a confidence score of 0.83, and ADMETlab 3.0 predicted this outcome at 0.689. For nirmatrelvir, ADMETlab 3.0 returned 0.988, the highest organ-level value of that dataset, ProTox 3.0 returned an active class with a confidence score of 0.70, and Deep-PK returned a toxic classification with a probability of 0.809. The direction was identical for the two molecules while the relative contribution of each tool differed, the ADMETlab 3.0 output being moderate for ensitrelvir and near-maximal for nirmatrelvir and the Deep-PK output showing the reverse pattern.

The lung-derived cell-line endpoint did not follow the organ-level signal for either compound: A549 cytotoxicity was 0.080 for ensitrelvir and 0.032 for nirmatrelvir, indicating that in neither case was the convergent respiratory prediction accompanied by a corresponding cell-viability signal in the airway-derived line included in the panel.

3.4. Nephrotoxicity and Cellular Toxicity

Nephrotoxicity produced the same internal disagreement in both datasets. ADMETlab 3.0 returned a drug-induced nephrotoxicity value of 0.993 for ensitrelvir and 0.938 for nirmatrelvir, in both cases among the highest organ-specific outputs of the respective dataset, whereas ProTox 3.0 classified the same general domain as inactive with confidence scores of 0.58 and 0.60. The domain was therefore prioritized for both compounds on the basis of a single platform, and the ADMETlab 3.0 model reports a modest Matthews correlation coefficient of 0.471.

Cellular toxicity, by contrast, separated the two molecules sharply and did so in the cell line most relevant to the renal prediction. ADMETlab 3.0 returned 0.847 for HEK293 cytotoxicity in ensitrelvir against 0.130 in nirmatrelvir, a difference of 0.717 and the third largest inter-compound separation recorded on the ADMETlab 3.0 probability scale. The remaining cellular outputs were low and similar for both: A549 cytotoxicity was 0.080 and 0.032, the RPMI-8226 output was 0.056 and 0.035, and ProTox 3.0 classified broad cytotoxicity as inactive for both, with confidence scores of 0.60 and 0.67. The HEK293 result was therefore the only positive cellular output anywhere in the comparison, and it belonged to ensitrelvir alone.

3.5. Hepatotoxicity and Drug-Induced Liver Injury

The hepatic domain produced the largest and most systematic separation between the two compounds, and it was the only domain in which every available endpoint moved in the same direction. For ensitrelvir, ADMETlab 3.0 returned the maximum value of 1.000 for drug-induced liver injury and 0.994 for human hepatotoxicity, and Deep-PK classified the compound as toxic for drug-induced liver injury with a probability of 0.693. For nirmatrelvir the same three models returned 0.314, 0.456 and a safe class with a probability of 0.222. ProTox 3.0 classified human hepatotoxicity as inactive for both compounds but with markedly different confidence, 0.55 for ensitrelvir, the lowest confidence value returned within its organ-toxicity panel for that molecule, against 0.87 for nirmatrelvir.

Three of the four hepatic outputs were therefore positive for ensitrelvir, two of them at or near the maximum of their respective scales, while all four were negative to borderline for nirmatrelvir. The differences of 0.686 for drug-induced liver injury and 0.538 for human hepatotoxicity rank fourth and sixth among all inter-compound separations recorded on the ADMETlab 3.0 probability scale. The reported performance of the models concerned varies: the ADMETlab 3.0 drug-induced liver injury model reports an area under the curve of 0.899 and a Matthews correlation coefficient of 0.667, the human hepatotoxicity model 0.794 and 0.413, and the Deep-PK model a low coefficient of 0.37.

3.6. hERG-Related Cardiotoxicity

The cardiac domain was the second in which the specialized tool and the general platforms separated the two compounds consistently, although the absolute magnitude of the difference was smaller than in the hepatic domain. Pred-hERG 5.0 returned a moderate-blocker class for ensitrelvir with a predicted pIC50 of 5.394, a value above the 5.0 boundary that bounds the platform’s weak-blocker band from above and, under the binary criterion of a half-maximal inhibitory concentration at or below 10 µM, on the blocker side of the threshold. For nirmatrelvir the same tool returned a weighted-consensus classification of non-blocker with a regression output of 4.953. That value requires explicit reading, because the platform documents two conversion schemes: under the multiclass scheme a pIC50 below 5 is a non-blocker, whereas the regression-to-class conversion assigns values between 4.5 and 5 to a weak-blocker band. The consensus classification for nirmatrelvir was therefore negative, but the regression output sits 0.047 log units below the moderate-blocker cut rather than deep within non-blocker space, and the difference between the two compounds on the regression axis is 0.441 log units.

ADMETlab 3.0 separated the compounds in the same direction and more cleanly. The hERG blockers endpoint returned 0.172 for ensitrelvir and 0.029 for nirmatrelvir, and the hERG blockers at 10 µM endpoint returned 0.389 and 0.095. Both ensitrelvir values remain below the decision threshold, so this platform does not classify ensitrelvir as a blocker either; it places it approximately four times higher than nirmatrelvir on the first endpoint and four times higher on the second. The first of these is produced by the model with the highest reported area under the curve among the hERG-related models applied here, 0.937 against 0.844 for the 10 µM endpoint and 0.82 for the Pred-hERG 5.0 binary model. ProTox 3.0 classified broad cardiotoxicity as inactive for both compounds, with confidence scores of 0.86 and 0.83. Within the ProTox 3.0 target panel, the ryanodine receptor and the voltage-gated sodium channel were inactive for both molecules.

3.7. Neurotoxicity and Ototoxicity

Both general neurotoxicity models produced positive findings for both compounds. ADMETlab 3.0 predicted drug-induced neurotoxicity at 0.999 for ensitrelvir and 0.898 for nirmatrelvir, and ProTox 3.0 returned active classes with confidence scores of 0.89 and 0.61. Within the neural target panel from ProTox 3.0, acetylcholinesterase, the ryanodine receptor, the gamma-aminobutyric acid receptor, the N-methyl-D-aspartate receptor, the α-amino-3-hydroxy-5-methyl-4-isoxazolepropionic acid receptor, the kainate receptor and the voltage-gated sodium channel were classified as inactive for both molecules, so no target-level output supported the broad prediction in either case.

Two further endpoints bear on this domain without being equivalent to each other, and they separated the compounds. ADMETlab 3.0 returned a blood–brain barrier penetration probability of 0.004 for ensitrelvir and 0.000 for nirmatrelvir. The corresponding ProTox 3.0 endpoint measures barrier toxicity rather than penetration and was active for ensitrelvir with a confidence score of 0.85 but inactive for nirmatrelvir with a confidence score of 0.52, one of the two lowest values recorded in that panel for the compound. Ototoxicity, evaluated by a single platform, was high for both molecules, at 0.968 for ensitrelvir and 0.827 for nirmatrelvir, from a model reporting an area under the curve of 0.786 and a Matthews correlation coefficient of 0.406.

3.8. Carcinogenicity, Hematotoxicity and Immunotoxicity

These three domains discriminated between the compounds in the same direction as the hepatic domain, each on the basis of a single positive output for ensitrelvir against convergent or single-tool negatives for nirmatrelvir.

Carcinogenicity produced the second largest inter-compound separation recorded on the ADMETlab 3.0 probability scale. ADMETlab 3.0 returned 0.926 for ensitrelvir and 0.180 for nirmatrelvir, a difference of 0.746, while ProTox 3.0 classified the endpoint as inactive for both, with confidence scores of 0.58 and 0.60, and Deep-PK returned safe classifications with probabilities of 0.308 and 0.177. The positive result was therefore limited to one platform and one compound, and the model producing it is the weakest-performing of the panel, with a reported area under the curve of 0.745 and a Matthews correlation coefficient of 0.342.

Hematotoxicity, evaluated by a single tool, returned 0.618 for ensitrelvir and 0.170 for nirmatrelvir, a moderate signal in the first case and a clear negative in the second. For immunotoxicity, ProTox 3.0 returned an active class for ensitrelvir with a confidence score of 0.92 and an inactive class for nirmatrelvir with a confidence score of 0.63, while the cell-specific RPMI-8226 output from ADMETlab 3.0 was low for both, at 0.056 and 0.035. The global and cell-specific outputs therefore agreed for nirmatrelvir and contradicted each other for ensitrelvir.

3.9. Systemic Toxicity

Systemic toxicity separated the compounds in the opposite direction. ADMETlab 3.0 predicted rat oral acute toxicity at 0.488 for ensitrelvir, a value adjacent to the classification threshold, and at 0.915 for nirmatrelvir, corresponding to a high probability of the high-toxicity category defined by a median lethal dose below 500 mg/kg. The FDA maximum recommended daily dose endpoint was similar for both, at 0.845 and 0.863, and ProTox 3.0 classified broad clinical toxicity as active for both, with confidence scores of 0.57 and 0.63.

Deep-PK returned 2.69 and 3.28 for rat acute median lethal dose and 1.25 and 1.46 for the rat chronic oral lowest-observed-adverse-effect level, both reported on platform-internal scales without a stated unit or transformation. The maximum recommended tolerated dose was 0.47 for ensitrelvir and −0.01 log(mg/kg/day) for nirmatrelvir. This endpoint requires an explicit caveat, because the platform labels values at or below 0.477 log(mg/kg/day) as low or non-toxic, a convention that runs counter to the usual reading of a maximum tolerated dose; the ensitrelvir value falls just below that boundary and the nirmatrelvir value well below it. Because these outputs represent different measures of systemic toxicity expressed on non-comparable scales, they were examined individually and retained as exploratory findings.

3.10. Stress-Response, Mitochondrial, Endocrine and Target-Level Endpoints

Mitochondrial membrane potential was consistently negative for both compounds and across all three tools evaluating it. SR-MMP was 0.000 for ensitrelvir and 0.045 for nirmatrelvir in ADMETlab 3.0, inactive in ProTox 3.0 with confidence scores of 0.83 and 0.86, and safe in Deep-PK with probabilities of 0.143 and 0.003.

The antioxidant response element was the single crossed endpoint of the comparison. ADMETlab 3.0 returned 0.048 for ensitrelvir and 0.942 for nirmatrelvir, the largest inter-compound separation recorded on that scale, at 0.894, while Deep-PK reversed the order entirely, classifying ensitrelvir as toxic with a probability of 0.626 and nirmatrelvir as safe with a probability of 0.115. ProTox 3.0 classified the endpoint as inactive for both, with confidence scores of 0.95 and 0.93. No consistent direction can therefore be assigned to either compound at this endpoint, and the domain was retained as exploratory. SR-HSE was low or negative across the three tools for both molecules.

Endocrine-related endpoints were predominantly low, inactive or safe for both compounds across the three platforms evaluating them. In ADMETlab 3.0 the values for ensitrelvir and nirmatrelvir were 0.012 and 0.007 for the androgen receptor, 0.000 and 0.001 for the androgen receptor ligand-binding domain, 0.010 and 0.232 for aromatase, 0.000 and 0.213 for the oestrogen receptor, 0.000 and 0.004 for the oestrogen receptor ligand-binding domain, and 0.000 and 0.015 for peroxisome proliferator-activated receptor gamma. ProTox 3.0 classified the same six endpoints as inactive for both, with confidence scores between 0.86 and 0.98 for ensitrelvir and between 0.87 and 0.98 for nirmatrelvir, and Deep-PK returned safe classifications for all of them and for the thyroid receptor. Transthyretin, thyroid hormone receptor alpha, thyroid hormone receptor beta and the sodium-iodide symporter were inactive in ProTox 3.0 for both. No prolactin-related or hypothalamic-pituitary endpoint was available in any panel.

Within the remaining toxicity-associated targets, the constitutive androstane receptor and the NADH oxidase endpoint were inactive for both compounds. The pregnane X receptor was the only target that changed class between the molecules, inactive for ensitrelvir with a confidence score of 0.63 and active for nirmatrelvir with a confidence score of 0.66.

3.11. Local Tolerance and Environmental Toxicity

Ocular local tolerance was negative for both compounds and was produced by the highest-performing models of the whole panel. ADMETlab 3.0 returned 0.000 for eye corrosion in both cases, with a reported area under the curve of 0.996 and a Matthews correlation coefficient of 0.934, and 0.002 and 0.083 for eye irritation, with 0.973 and 0.857. Deep-PK returned safe classifications for both endpoints and both compounds. Skin sensitization separated the molecules: ADMETlab 3.0 returned 0.020 for ensitrelvir and 0.586 for nirmatrelvir, the latter a borderline value of limited relevance for an orally administered compound, while Deep-PK returned safe classifications for both.

Environmental toxicity produced mixed results and several outputs that were not directly comparable between platforms. ProTox 3.0 classified ecotoxicity as inactive for both compounds, with borderline confidence scores of 0.50 and 0.52. Deep-PK predicted honeybee acute toxicity as toxic for both, with probabilities of 0.54 and 0.939, and avian toxicity as safe, with probabilities of 0.043 and 0.016. The bioconcentration factor was 1.391 and 0.931 in ADMETlab 3.0 against −0.15 and −1.12 in Deep-PK, values expressed in different conventions and therefore not directly comparable. Three outputs met the criterion for non-interpretability and were treated as such rather than as findings: the Deep-PK growth-inhibition concentration values of −1174.06 and −124.89, which are inconsistent with the corresponding ADMETlab 3.0 values of 3.96 and 3.603; the Deep-PK biodegradation endpoint, which carries a reported set size of 1.66; and the single admetSAR 3.0 output, a bacterial mutagenicity endpoint accompanied by a reported total set of zero records. A fourth output was retained but downweighted on a different basis: the Deep-PK fathead minnow lethal concentration model reports a coefficient of determination of 0.16, which is a question of model reliability rather than of internal consistency. The direction of the biodegradation class label is not resolved by the platform documentation and is reported here as returned.

Overall, four domains were shared positive between the two compounds: genotoxicity with micronucleus formation, respiratory toxicity, nephrotoxicity and neurotoxicity, with ototoxicity high in a single tool for both. Six domains discriminated in favour of a higher predicted signal for ensitrelvir: hepatotoxicity and drug-induced liver injury, hERG-related electrophysiology, carcinogenicity, HEK293 cytotoxicity, hematotoxicity and immunotoxicity. Four discriminated in the opposite direction: systemic acute toxicity, the antioxidant response element in one of the three tools evaluating it, pregnane X receptor activity and skin sensitization. Mitochondrial, endocrine, neural target and ocular endpoints were convergent-negative for both.

4. Discussion

The most general result of this comparison is that a shared molecular target and a shared therapeutic indication do not produce a shared predicted toxicological profile. Of the 93 class-assignable endpoint pairs, 20 assigned the two compounds to different categories, and those 20 are not scattered evenly across the panel: they concentrate in the hepatic, cardiac, carcinogenicity, cellular, haematological and immunological domains in one direction and in the systemic, oxidative-stress, receptor-activation and skin-sensitization domains in the other. At the same time, the four domains that were shared positive are precisely those in which both molecules trigger the same models at high magnitude. The comparison therefore separates two questions that a single-compound analysis cannot distinguish: whether a signal reflects a property of the individual molecule, or whether it recurs across chemically unrelated inhibitors of the same target and is better treated as a class-level or model-level observation.

Genotoxicity is the clearest instance of the second case. Two chemically unrelated molecules, one carrying an electrophilic nitrile warhead and one carrying no reactive warhead at all, received the maximum output of the same high-performing genotoxicity classifier and the maximum micronucleus probability from a second platform. That coincidence weakens a mechanistic explanation that would otherwise be natural for nirmatrelvir alone. The nitrile warhead is an electrophile and structural alerts of this class frequently drive genotoxicity classifiers, but the reactivity demonstrated experimentally is a reversible covalent adduct with the catalytic cysteine of a viral protease [1], a specific thiol-directed interaction that is not equivalent to reactivity toward DNA. If the warhead were driving the prediction, ensitrelvir should not reproduce it; ensitrelvir reproduces it exactly. The more parsimonious reading is that these classifiers respond to features shared by both scaffolds, or to the general region of chemical space occupied by main protease inhibitors, rather than to a specific electrophilic liability. This pattern raises the possibility that the shared positive predictions reflect classifier-specific structural features or applicability-domain limitations, although experimental testing is required to distinguish such model-related effects from a genuine shared genotoxic liability.

Two further considerations temper the domain in both compounds: the broad genotoxicity endpoint aggregates heterogeneous experimental outcomes and is not equivalent to the result of any single assay, and the negative SR-p53 and SR-ATAD5 outputs argue against a classical DNA-damage-response mechanism in either molecule. The bacterial mutagenicity results reinforce the caution rather than resolving it. When three platforms evaluating the same assay disagree to the extent observed here, and reverse their relative ordering between two compounds, the responsible interpretation is that the endpoint is unresolved computationally for both molecules, not that a consensus favours one direction. No primary bacterial reverse mutation or micronucleus report satisfying the evidence gate was identified for either compound, so the domain with the strongest computational signal in the entire comparison is also the one with the weakest auditable evidential support on both sides.

Respiratory toxicity is the second shared-positive domain, with a the one for which a directional experimental counterpart exists on one side only. Agreement across three prediction platforms was stronger than for most other organ-specific endpoints for both molecules. For nirmatrelvir, a single oral dose of 1000 mg/kg in male rats produced an increase of approximately 44% in respiratory rate together with transient changes in locomotor activity, with normalization within a few hours and no persistent alteration of the functional observational battery [5]. The correspondence between a convergent computational signal and an observed functional respiratory effect is notable, but the rodent finding is a transient functional change at a very high exposure and not a structural or histopathological lesion, and the computational endpoints classify compounds according to reported adverse effects on the human respiratory system without carrying any exposure dimension. For ensitrelvir no comparable primary experimental report was identified, so the same convergent signal has no counterpart at all. The low A549 cytotoxicity outputs for both compounds indicate that in neither case is the prediction driven by a general cytotoxic effect in an airway-derived line. The distinction between a screening classification and a clinical phenotype is particularly important for compounds administered to patients with an active respiratory infection, in whom a treatment-emergent respiratory event would be difficult to separate from disease progression, and for a post-exposure prophylaxis population in whom respiratory symptoms are the primary efficacy outcome [14].

The hepatic domain is the largest discriminant finding of the comparison and the one where the temptation to convert prediction into clinical claim is strongest. Every hepatic endpoint moved in the same direction, giving ensitrelvir the maximum possible drug-induced liver injury value and a near-maximal human hepatotoxicity value against low-to-borderline outputs for nirmatrelvir, and the ProTox 3.0 negative class was returned with high confidence for nirmatrelvir and with the lowest confidence of its organ-toxicity panel for ensitrelvir. The internal coherence of this pattern is unusual in a dataset otherwise characterized by inter-tool disagreement. It nevertheless remains a structure-based classification without reference to dose, duration or exposure, and must be read against clinical records that do not support a difference in this magnitude: neither compound produced a consistent signal of severe liver injury in its randomized trials [7,12,13,14], and for nirmatrelvir the primary nonclinical evidence describes adaptive, reversible hepatocellular hypertrophy in rats and reversible transaminase elevations in monkeys at 600 mg/kg/day without histopathological correlate [5]. Short courses in trials with clinical exclusion criteria are poorly suited to detecting rare or idiosyncratic drug-induced liver injury, and for nirmatrelvir clinical hepatic events under the combination regimen cannot be attributed to either component without a dedicated design [4]. The reproducible, reversible reductions in high-density lipoprotein observed clinically with ensitrelvir are not captured by any endpoint of the panel [10,12].

Although the panel is structure-based and carries no exposure dimension, the direction and internal coherence of the hepatic separation invite a testable mechanistic hypothesis. The two molecules differ markedly in disposition: nirmatrelvir, whose half-life is considerably prolonged by ritonavir [8,28] and is eliminated largely through renal excretion of unchanged drug. In a human mass-balance study, 47.0% of the administered dose was recovered in urine, with unchanged nirmatrelvir representing 82.5% of the drug-related material; hydrolysis of the P2 amide bond, rather than oxidative hepatic metabolism, was the main biotransformation pathway identified [29]. Consistent with this elimination route, nirmatrelvir exposure increases with the severity of renal impairment [9]. Ensitrelvir has a different disposition profile. It is a lipophilic, halogenated triazinedione with a long elimination half-life of approximately 42–59 h, which supports once-daily dosing [10]. It is also a strong, time-dependent inhibitor of CYP3A [30]. These properties may result in more sustained hepatic exposure and make CYP3A-mediated interactions particularly relevant to its clearance. Together, prolonged exposure, lipophilicity, and CYP3A inhibition provide a possible pharmacokinetic basis for the higher hepatic scores observed for ensitrelvir. Conversely, the predominantly renal elimination of unchanged nirmatrelvir may be consistent with its lower predicted hepatic scores. This hypothesis remains speculative: the predictions encode no dose or duration, idiosyncratic drug-induced liver injury is not necessarily exposure-driven, and the clinical record cited above does not support a hepatic difference in the predicted magnitude. It is stated because it is falsifiable: hepatocyte assays anchored to clinically relevant exposures, bile-acid-transporter inhibition testing and mitochondrial toxicity assessment would confirm or refute it directly.

The cardiac domain discriminates in the same direction but at a much smaller absolute magnitude. All four cardiac outputs for nirmatrelvir agreed on the absence of a prioritized electrophysiological signal, and the primary nonclinical evidence points the same way: in eight telemetered cynomolgus monkeys, only transient increases in arterial pressure and decreases in heart rate appeared, mainly at the highest dose (75 mg/kg twice daily), with no QTc prolongation and no arrhythmia; the maximum concentration at that dose, approximately 14.7 ± 9.24 µg/mL [5], is roughly threefold the human steady-state maximum of approximately 5.1 µg/mL at 250 mg twice daily [8], although the cross-species comparison is not corrected for free fraction. For ensitrelvir the same panel returned consistently higher values, the specialized tool returning a moderate-blocker class at a predicted pIC50 of 5.394 while the ADMETlab 3.0 classifier with the highest reported area under the curve returned only 0.172. A pIC50 of 5.394 corresponds to a micromolar-range IC50 and would not usually be a high-priority alert in isolation; its relevance derives from the absence of any published experimental counterpart. The domain therefore has an asymmetric resolution: for nirmatrelvir the computational consensus and in vivo telemetry agree and support deprioritization; for ensitrelvir the prediction is higher, discordant between tools, and has nothing to be checked against.

Nephrotoxicity behaves in the opposite way to the hepatic domain. The organ-level prediction was high for both compounds and inactive in the second platform for both, so nothing distinguishes them at that level. What distinguishes them is the cellular layer beneath it: for ensitrelvir, HEK293, a line of renal origin, was the only cell line in the entire comparison with a positive cytotoxicity prediction, at 0.847, while A549 and RPMI-8226 were clearly negative; for nirmatrelvir the same line returned 0.130. This coincidence is suggestive, but both outputs originate from the same platform and from models with modest reported Matthews correlation coefficients, so the coherence is internal rather than independent. Neither prediction should be conflated with the clinical renal data, which describe how impaired renal function alters exposure [9,11] rather than whether the compound injures the kidney; a compound whose clearance depends on renal function is not thereby nephrotoxic. For nirmatrelvir the primary repeat-dose studies in rats and monkeys did not identify the kidney as a target organ [5].

Neurotoxicity is shared positive but unsupported at every other level of the analysis in both compounds. Two general models agreed for each molecule, yet every neural target evaluated was inactive for both. The distribution-level endpoints do not corroborate a central mechanism either, and they must not be conflated: the ADMETlab 3.0 endpoint measures blood–brain barrier penetration, predicted as essentially absent for both compounds, whereas the ProTox 3.0 endpoint measures barrier toxicity and is therefore not an independent confirmation of it; that second endpoint was active for ensitrelvir and inactive at low confidence for nirmatrelvir, leaving the ensitrelvir side unresolved within the dataset. The primary counterparts are modest on both sides: transient functional effects at 1000 mg/kg in rats without persistent changes or neurohistopathological correlates for nirmatrelvir [5], and mild neurological events for ensitrelvir, with headache the most frequent and the somnolence in the first-in-human study confounded by concomitant midazolam [10]. Ototoxicity is high for both compounds from a single model with a reported Matthews correlation coefficient of 0.406, with no corroborating tool and no admissible comparator, and is retained as a shared exploratory finding for that reason.

The remaining ensitrelvir-side discriminant domains each rest on a single positive output and should be treated as lower-ranked prioritization markers. The carcinogenicity difference is the second largest recorded on the ADMETlab 3.0 scale, yet it was produced by the weakest-performing model of the panel and was contradicted by two other tools for ensitrelvir, while all three agreed on a negative for nirmatrelvir. No carcinogenicity study satisfying the evidence gate was identified for either compound; the absence of a study is not a negative result, and agreement between models must not be used to fill that gap. Hematotoxicity moderately separated the compounds on a single ADMETlab 3.0 endpoint, contradicted for nirmatrelvir by primary evidence in the informative direction: repeat-dose studies in rats reported prolongation of prothrombin time to approximately 1.06–2.50 times control and platelet counts of approximately 1.12–1.28 times control at 200 mg/kg/day and above [5]. Those changes were judged non-adverse and showed complete or partial recovery, but they are a real, dose-related effect that the low computational output did not capture, probably because hematotoxicity classifiers are trained largely on cytopenias and marrow-directed toxicity and do not encode coagulation-pathway effects. That observation transfers directly to ensitrelvir, whose higher hematotoxicity output is equally uninformative about coagulation; the domain would have to be tested rather than read off the panel for either compound. Immunotoxicity is unresolved rather than negative for ensitrelvir and convergent-negative for nirmatrelvir.

Two domains discriminating in the opposite direction deserve comment. The rat oral acute toxicity value of 0.915 for nirmatrelvir implies a high probability of a median lethal dose below 500 mg/kg, which is directly contradicted by primary data in which rats tolerated repeated administration up to 1000 mg/kg/day for up to one month without adverse findings and a single dose of 1000 mg/kg produced only transient functional effects [5]. The ensitrelvir value of 0.488 sits at the decision boundary and has no primary comparator. Together with the maximum recommended daily dose outputs, which are nearly identical for the two compounds despite their different clinical dose levels, these endpoints behave as structure-based dose-class classifiers rather than as toxicity predictors and should not be used to constrain dose selection for either molecule. The pregnane X receptor result is the more interesting of the two, because it is the only target-level endpoint that changes class between the compounds and because it is mechanistically legible. For nirmatrelvir it converges with a primary rodent phenotype: the one-month study described adaptive changes in the thyroid and pituitary alongside increased liver weight up to approximately 1.83 times control values and periportal hepatocellular hypertrophy [5], the classical rodent pattern of hepatic enzyme induction with secondary thyroid hormone clearance rather than direct nuclear receptor agonism, which is exactly what a panel built on receptor-activation endpoints would fail to detect.

Since the pregnane X receptor is the principal transcriptional regulator of cytochrome P450 3A expression, and since the clinical regimen deliberately inhibits that enzyme with ritonavir [4], any intrinsic induction potential of nirmatrelvir would be masked in clinical pharmacokinetic data and would have to be characterized in vitro. The corresponding inactive class for ensitrelvir, returned at a low confidence of 0.63, does not exclude the same mechanism but does not support it either. An additional interpretive complication is that ensitrelvir itself is a strong CYP3A inhibitor: clinical coadministration increased midazolam exposure approximately 6.8-fold, while in vitro data demonstrated time-dependent NADPH-mediated CYP3A inhibition [30]. Thus, the inactive PXR prediction should not be interpreted as evidence of metabolic neutrality, and any net CYP3A phenotype would need to distinguish receptor-mediated induction from direct enzyme inhibition. The antioxidant response element is the one endpoint at which the tools cross: the two platforms that disagree place the compounds in opposite orders, so no direction can be assigned to either molecule and the domain is exploratory on both sides.

The convergent-negative domains require their own discipline of interpretation, and their agreement across two structurally unrelated molecules makes them more informative here than in a single-compound analysis. Mitochondrial membrane potential was negative for both compounds across three tools; the nuclear receptor and thyroid-related panel comprised twenty-three endpoints that were low, inactive or safe for both; the neural target panel was uniformly inactive for both; and the ocular local tolerance endpoints were negative for both, produced by the models with the highest reported performance of the entire panel. These results reduce the priority of those domains for both molecules, but they apply only to the targets and endpoints directly examined and do not exclude effects outside the prediction panel. Two domains illustrate the opposite failure mode, in which primary experimental findings exist but the panel does not represent them: coagulation and haemostasis, discussed above, and reproductive and developmental toxicity, for which no endpoint exists in any of the five platforms, although primary studies established no adverse effect on fertility or early embryonic development in rats up to 1000 mg/kg/day for nirmatrelvir, no teratogenic pattern in rats, and a developmental no-observed-adverse-effect level of 300 mg/kg/day in rabbits, where 1000 mg/kg/day was associated with a mean foetal weight reduction of approximately 9% in the presence of modest maternal signs [6]. Both cases show that a negative or absent computational output must not be read as an absence of biological effect, and neither can be resolved by comparing the two compounds, because the panel is blind to these domains for both.

The evidence asymmetry between the two molecules is itself a finding of this comparison and constrains every conclusion drawn from it. For nirmatrelvir, eight of the domains summarized in Figure 1 could be read against at least one directly inspected primary experimental report; for ensitrelvir, none of the prioritized domains could. That difference does not make one compound safer than the other; it changes what each prediction can be tested against, and therefore what a disagreement between the two profiles means.

Limitations

The main constraints of this analysis arise first from the comparison of only two compounds, which limits the generalizability of any class-level inference: a signal shared by ensitrelvir and nirmatrelvir may reflect a property of the broader class of main protease inhibitors, but it may equally reflect a coincidence of two unrelated scaffolds or a shared bias of the prediction models within this region of chemical space, and only comparison with additional Mpro inhibitors could distinguish these possibilities. Further constraints arise from the evidence asymmetry, from the restrictive evidence gate, from the uneven representation of domains across platforms, and from the absence of uniform applicability-domain information across endpoints.

The gate necessarily converts several domains into evidence gaps by construction rather than by the state of the science, and its consequences fall unequally on the two compounds. Several endpoints were evaluated by only one platform, including hematotoxicity, ototoxicity and the maximum recommended daily dose, so no convergence assessment was possible for them in either molecule; where such an endpoint also discriminates between the compounds, the difference rests on one model alone. Several of the models producing the strongest positive or most discriminant outputs report modest Matthews correlation coefficients, and this was taken into account during prioritization. Unit conventions differed between platforms for the bioconcentration factor and the aquatic endpoints; three outputs, two of them environmental and one a bacterial mutagenicity endpoint, carried an internally inconsistent reported value or set size and were excluded from prioritization; and a further environmental model reports a coefficient of determination of 0.16. Together these illustrate that platform-level metrics do not guarantee endpoint-level reliability. The predictions for ensitrelvir were generated for the free base whereas the clinical product is the fumaric acid salt, and all predictions for nirmatrelvir describe a single entity rather than the co-administered clinical regimen; the first distinction does not affect the structural basis of the predictions and the second is both a strength, because it avoids attributing ritonavir-driven effects to the antiviral, and a limitation, because it does not represent the pharmacological system to which patients are actually exposed. Finally, the equal-panel design that makes this comparison possible also means that any systematic bias of a model within the chemical space occupied by main protease inhibitors would affect both compounds in the same direction and would be invisible to the comparison itself.

The findings support a sequential experimental programme organized by whether a priority applies to the class or to one molecule. The first tier is shared: independent genotoxicity testing for both compounds, comprising a bacterial reverse mutation assay, an in vitro chromosomal damage assay and an in vivo micronucleus study, together with respiratory function and airway-cell assays anchored to clinically relevant exposures. The second tier is compound-specific and is dominated by ensitrelvir: hepatocyte-based injury and mitochondrial function models, and direct hERG patch-clamp determination with exposure-margin calculation, address the two highest-priority compound-specific domains, where ensitrelvir has both the higher prediction and no experimental counterpart. The third tier is shared in design but differently weighted: renal proximal tubular cell models at concentrations representative of severe renal impairment apply to both compounds, the HEK293 signal giving ensitrelvir the additional cellular question; coagulation-focused haematological assays are indicated for both, since the panel does not encode the relevant pathway for either; and in vitro characterization of pregnane X receptor activation and CYP3A4 induction in human hepatocytes tests the PXR-mediated hypothesis raised by nirmatrelvir while evaluating the contrasting prediction for ensitrelvir, bearing in mind that ensitrelvir is itself a strong, time-dependent CYP3A inhibitor [30], so transcriptional induction should be distinguished from net enzymatic activity. Neuronal viability assays place the convergent neurotoxicity prediction in context for both. Carcinogenicity, endocrine, ocular local tolerance and environmental endpoints do not require immediate experimental attention for either compound on the basis of this dataset.

5. Conclusions

This matched in silico comparison of ensitrelvir and nirmatrelvir under an identical 105-endpoint panel found that the two main protease inhibitors share a molecular target but not a predicted toxicological profile. Seventy-three of ninety-three class-assignable endpoint pairs placed both compounds in the same category, sixty-two of them negative, and twenty separated them. Genotoxicity with micronucleus formation, respiratory toxicity, nephrotoxicity and neurotoxicity were positive for both molecules and are therefore class-level validation priorities; ototoxicity was high for both from a single tool. Hepatotoxicity and drug-induced liver injury produced the largest and most systematic separation, with every endpoint positive for ensitrelvir and negative to borderline for nirmatrelvir, followed by hERG-related electrophysiology, carcinogenicity, HEK293 cytotoxicity, hematotoxicity and immunotoxicity in the same direction, and by systemic acute toxicity, pregnane X receptor activity and skin sensitization in the opposite one. Mitochondrial, endocrine, neural target and ocular endpoints were convergent-negative for both.

Two observations qualify every comparison drawn here. First, the identical maximal genotoxicity and micronucleus outputs obtained for a covalent and a non-covalent inhibitor argue that these classifiers are not responding to the electrophilic warhead of one of the molecules, and therefore that the strongest signal in the dataset is the least compound-specific. Second, the primary experimental evidence available for the two compounds is markedly unequal, so a difference between their computational profiles can be tested against experiment on one side only in most domains, and not at all in several. Neither compound can be described as safer than the other on the basis of these data, and no prediction reported here constitutes evidence of confirmed clinical or experimental toxicity.

The main priorities for subsequent investigation are, for both compounds, independent genotoxicity and micronucleus testing and respiratory function and airway-cell assays anchored to clinical exposure; for ensitrelvir specifically, hepatocyte-based injury models and direct hERG patch-clamp testing with exposure-margin determination; and for both again, renal proximal tubular models evaluated at exposures representative of severe renal impairment, coagulation-focused haematological assays, and in vitro characterization of pregnane X receptor activation and cytochrome P450 3A induction potential. Further studies in these areas will clarify which of the differences observed here reflect the chemistry of the individual molecules and which reflect the behaviour of the prediction models within a single target class. Beyond these compound-specific priorities, three future directions follow from the design of this study. First, the same matched-panel approach should be extended to the other main protease inhibitors now in clinical use, such as simnotrelvir and leritrelvir, to establish which of the shared signals reported here are genuinely class-level properties. Second, as compound-specific nonclinical data for ensitrelvir enter the primary literature, the concordance between prediction and experiment should be re-evaluated quantitatively, converting hypothesis-generating flags into tested ones. Third, incorporating exposure data, through measured or predicted free plasma concentrations set against endpoint-specific potency estimates, would convert the present structure-based prioritization into a risk-based assessment.