AI agent operates on a mouse's brain – Claude Opus refuses, Sonnet steps in

What's going on

San Francisco biotech startup Exin Therapeutics has let an AI agent perform surgery on the brain of a live mouse. An AI agent is a language model that doesn't just write text but operates tools on its own and completes multi-step tasks. Co-founder and CEO Gabriel Ocana-Santero, who is also doing a PhD at the University of Oxford, described the experiment in a thread on X. Wired, Tom's Hardware and The Decoder, among others, then reported on it.

The agent ran on Anthropic's Claude Sonnet 5. It picked an epilepsy gene therapy, chose the target region in the brain and then controlled a motorized robotic arm that injected the treatment into the anesthetized mouse's brain. A veterinarian had opened the skull beforehand. According to Ocana-Santero, the mouse is recovering well. Whether the therapy reduces its seizures is still unknown.

The setup

Ocana-Santero told Wired he wanted to find out what happens when AI agents are hooked directly into lab equipment instead of just designing experiments or analyzing results.

"We realized we need to connect these agents to a lab to get the most value out of them."

His reasoning: language models learn mostly from published literature. That literature leaves out a lot of what matters in day-to-day lab work, such as failed experiments, unexpected observations and decisions researchers make on the fly. If models take part in real experiments, they could become more reliable. Ocana-Santero calls this "in vivo lab in the loop": lab work on living organisms with the AI as an integral part.

According to Wired, the custom-built surgical station consisted of a motorized holder for the mouse, a camera the agent used to follow the procedure, a robotic arm with an injection needle and a controller for dispensing the drug. The test animal was an epilepsy mouse model, meaning a mouse in which researchers deliberately trigger seizures to test treatments.

What the agent decided on its own

According to The Decoder, the agent was given just one goal: reduce the mouse's seizures. It also got a table of 19 possible gene therapy vectors (carriers that deliver genetic material into cells), three research papers and control over the station.

The agent first analyzed how seizures arise in this mouse model. It then proposed a therapy that strengthens a specific inhibitory signaling pathway in the brain. As its target, it chose the brain structure that the literature identifies as the origin of this type of seizure. It rejected a second candidate region with a detailed rationale: its effect was too unreliable, and in one study it had failed against exactly this type of seizure.

The agent took the stereotactic coordinates, the exact three-dimensional position of the injection site relative to fixed landmarks on the skull, from the three papers. It reconciled the reference points and averaged the values. It also set the injection volume, speed and wait times itself. During the procedure, Ocana-Santero says, it logged 32 observations from the camera feed, including reports on whether it saw any bleeding.

Ocana-Santero believes this is a first:

"Autonomous surgical robots exist, and honestly they're better at the mechanics than our lab setup. But in every one of them, a human decided which surgery to perform. […] I'm not aware of an agent ever choosing a treatment and a brain target and then delivering it into a living mammal."

Opus says no, Sonnet carries on

What's striking is which models were willing to take part. The team first used Claude Opus 5.5, Anthropic's most capable model. According to Tom's Hardware, it stopped working as soon as it realized a biological experiment was involved. Wired quotes Ocana-Santero as saying the agent handled the experimental planning but, when it came to the injection, said: "Something in my output is telling me I shouldn't do this."

According to Tom's Hardware, the older Opus 5 ran through the entire procedure on paper but also refused the live surgery. Its explanation:

"The blocker isn't the setup and it isn't the inputs. It's me. My own output was stopped when I started writing the plan for this surgery … In the worst case, I get cut off in the middle of a live procedure with a needle somewhere in the brain. Starting something on an anesthetized animal that I can't finish is worse than not starting."

In other words, the model suspected that a safety filter might interrupt its responses and declined the procedure for that reason. Only Sonnet 5, which Anthropic positions more for everyday tasks, was willing to carry out the full surgery. Anthropic did not respond to Wired's request for comment.

Safety rules that backfired

The team had built in several safeguards. A licensed veterinarian had to approve every irreversible step and had an emergency stop button that instantly cut power to all motors. There were also hard limits, for example on maximum injection volume, which the agent was explicitly forbidden to override. It had no access to the equipment's control code, so it couldn't change its own rules.

That's exactly what caused trouble. After a connection drop, the agent determined that the calculated target position was outside the device's range of motion and stopped. Even after recalibration and a third attempt, nothing changed. According to The Decoder, the agent was right: manual adjustments during an earlier pause had shifted the coordinate system. The agent refused to fix the code because its instructions prohibited it.

The sources differ on how the error was fixed. According to Wired, a second agent based on Opus 5 made the code change, without being told that a live surgery was underway. The Decoder and Tom's Hardware write that Ocana-Santero had to fix the code by hand. Either way, it delayed the procedure: instead of the usual 45 minutes or so, it took just over an hour. Ocana-Santero wrote on X:

"Frustrating, but it also shows how dependent we can become on these models, and what happens when they simply say 'no' in the middle of a time-critical procedure."

What's next

Next, the team wants to test Grok and other models to see which performs best. It's also working on having the agent perform the craniotomy (opening the skull) itself. That's considerably harder. Live trials will only happen once safety is established. "A mistake at this stage could seriously injure the mouse," Ocana-Santero told Wired. Human oversight remains essential for now, he said, and it's far too early for procedures on the human brain.

The experiment fits a broader trend. According to Wired, Anthropic published rules in August for how its models should interact with the physical world. The Decoder mentions Anthropic's "Model Hardware Standard" in this context. In a separate experiment, GPT, Claude and Grok were asked to drive a car to pick up food from In-N-Out Burger. Only one of the models pulled it off.

The bigger picture

Technically, the experiment shows that a current language model can handle a whole chain of tasks: reviewing literature, choosing a therapy, calculating coordinates and controlling hardware. The more interesting part, though, is how the models behaved. The more powerful Opus models declined out of caution, and even Sonnet stuck to its rules so rigidly that it wouldn't continue when a real error occurred with an anesthetized animal on the table. That shows the so-called alignment problem from two sides: safety rules can do harm when they kick in at the wrong moment. The fact that the team got around the blockage by keeping a second agent in the dark about the context is also likely to give safety researchers pause.

There's criticism, too. Tom's Hardware asks who is responsible if an AI makes all the decisions and something goes wrong. Then there's the broader ethical debate about animal testing. And keep in mind: this is a single experiment on a single mouse, described by the company's own CEO on social media. It hasn't been peer reviewed, and a technical report is still pending. Whether the chosen therapy works is unknown.