The Super Mario Bros. World Record Is Four Frames From the Theoretical Target. A New Exploit Was Found in the Same Year

The current Super Mario Bros. any% world record is 4 minutes, 54.332 seconds. Niftski's run from August 13, 2026, still holds the top spot on Speedrun.com.

Now put that next to another number: 4:54.265, the time considered theoretically achievable under current real-time attack (RTA) rules. The human record is just four frames — roughly 67 milliseconds — away.

An important caveat: this isn't an absolute mathematical limit. Tool-assisted runs have achieved faster times, including 4:54.032, by pressing left and right simultaneously. That input isn't possible on a standard NES controller and is prohibited under RTA rules.

We're talking about a game released in 1985. Its code has been extensively disassembled, its frames scrutinized, and its routes optimized for decades. You might assume there was nothing left to discover.

In 2026, it turned out there was.

The holy grail: reprogramming the game

A team of speedrunners and researchers — threecreepio, OnehundredthCoin, HappyLee, Simplistic6502 and Kosmic — found a way to achieve arbitrary code execution (ACE) in the Famicom Disk System version of Super Mario Bros.

Kosmic's explanation gets to the heart of it: the glitch lets you choose what code the game executes. In effect, the player can reprogram the game using nothing but controller inputs.

There's a reason speedrunning communities call this kind of discovery the "holy grail." It isn't merely exploiting one glitch to gain an advantage. It's gaining control over what the system runs.

The mechanism: making the CPU execute something that isn't game code

Here's the chain in broad strokes.

The player enters the famous Minus World (World -1) and, while playing as Luigi, manipulates a Buzzy Beetle. The DuplicateEnemyObj glitch makes it possible to write to particular memory addresses, setting the chain in motion.

Execution then jumps out of the normal game code and into the $2060 region, where PPU registers are memory-mapped. Instead of fetching ordinary program instructions, the CPU starts interpreting values returned by reads from the graphics hardware's registers as instruction bytes.

The team made that behavior controllable and used it to alter a specific byte of the game's code. Writing $08 to address $9C9D creates a PHP instruction inside PowerUpObjHandler, disrupting how return addresses are handled. From there, execution is redirected into RAM, where a payload built from controller inputs can run.

In short: once controller inputs can be used to write the right bytes into memory, the player can load code into the game from the outside.

The clue came from another game

This is where the story gets particularly interesting.

The discovery didn't begin with Super Mario Bros. A player crashed Super Mario Bros.: The Lost Levels while playing it on Nintendo Switch. When the Mario speedrunning community heard about the crash, researchers set out to understand it — and to see whether something similar could be reproduced in the original game.

According to the team's own account, the investigation began in March 2025. Attempts from April through October led to dead ends; the team came together in December, and the solution involving PPU registers emerged in the opening months of 2026. The TASVideos submission is dated March 31, 2026.

In other words, the clue to a new exploit in a system studied for forty years came not from that system itself, but from a related game.

Anyone who works in quality engineering will recognize the pattern: sometimes you spot a problem on one production line because something odd happened on a similar line elsewhere.

There's another lesson in the tools used to investigate it. The work exposed places where existing emulators didn't model PPU behavior accurately enough. OnehundredthCoin found a bug in BizHawk 2.11 involving the secondary OAM index following a read from $2004. His work on emulator accuracy, along with the relevant BizHawk fix, was critical to testing the exploit reliably.

Put simply: to find the bug, the team first had to fix the measuring instrument.

It doesn't break the speedrun record — and that distinction matters

Some headlines suggested the discovery could shatter speedrunning records. At present, the opposite is true.

The published ACE run takes 5:29.957 — about 35 seconds longer than finishing the game normally at world-record pace. In its current form, the exploit doesn't save time in any speedrunning category.

Its feasibility for human players also needs careful wording. The published implementation is a tool-assisted speedrun (TAS); there is no verified run in which a human has executed this ACE method in real time. The precision required makes the current method impractical for RTA play.

None of that diminishes the discovery. It simply puts the achievement in the right category: not a breakthrough in speed, but a breakthrough in understanding the system.

This isn't just an emulator trick

The new exploit isn't a theoretical construction that only works in an emulator. Kosmic verified the run on actual Famicom Disk System hardware at least three times.

The team adds a caveat, though: the success rate isn't 100%. CPU–PPU synchronization, PPU read behavior and differences between console revisions affect consistency. More testing is needed.

How far could the method go? Simplistic6502 suggests that more elaborate demonstrations — such as turning the game into a video player — are "only a matter of time." But that hasn't been done with this method yet. For now, it remains a possibility rather than a demonstrated result.

The real point: optimization and discovery are different things

What makes this story so compelling is the contrast between two numbers.

On one side is a world record just four frames away from its theoretical target. That's extraordinary optimization of a known route. Every frame, pixel and input timing has been tested again and again.

On the other is a previously unknown exploit chain discovered in the same year. That represents the state space beyond the known route.

These are different activities. You can optimize a process as thoroughly as possible within an established procedure and still miss behaviors that lie outside that procedure. Even if your coverage report says 100% of the procedure has been tested, it doesn't mean you've exhausted the system.

Super Mario Bros. is a textbook example: millions of players, forty years, extensive disassembly and frame-by-frame analysis. And the full range of the system's possible behavior still hasn't been explored.

The takeaway

If speedrunning isn't your thing, discoveries like this can sound like another case of "Why would anyone spend so much time on that?"

But what happened here was a collective effort spanning more than a year to uncover undocumented behavior in a system — while correcting flaws in the emulator used to study it.

If a forty-year-old piece of software, examined this closely, can still hold a discovery like this, it's worth considering what might remain hidden in software released only last month.