AI agent mouse brain surgery: Claude picked the drug and guided the needle, then refused to go on

An AI agent running on Anthropic’s Claude Sonnet 5 chose a gene therapy for an epileptic mouse, worked out where in the brain to put it, and then steered a robotic needle to inject it into the living animal. The experiment was run by Exin Therapeutics, a small biotech startup, and described by its co-founder and CEO Gabriel Ocana-Santero, a PhD student at the University of Oxford, in a thread on X in the last week of October.

It is a real experiment, not a story about AI “going rogue”. But it is also self-reported, a single test on one mouse, and not yet peer-reviewed. Keep both in mind.

What the AI did, and what humans did

The team gave the agent one goal: reduce the mouse’s seizures. It had a list of 19 possible gene therapies, an epilepsy mouse model, and a custom motorised surgical rig with cameras.

According to Ocana-Santero’s account, the agent:

• picked a therapy that strengthens one of the brain’s “calming” (inhibitory) signalling pathways;
• chose the brain region that research papers name as the starting point for this type of seizure, and rejected a second option;
• took injection coordinates from three published papers, cross-checked them and averaged them;
• set the volume, the speed of the injection and the waiting times, and logged 32 observations during the procedure, such as “15 percent” injected with no visible bleeding.

Humans kept control of the dangerous parts. A licensed veterinarian approved every step that could not be undone and held a physical emergency stop. A human surgeon opened the skull, because the agent is not cleared for that. The rig had hard limits, such as a cap on how much liquid could be injected, that the agent was not allowed to change.

The moment it said no

Halfway through, a connection dropped. When it came back, the agent calculated that its target position was outside what the machine could physically reach, and it refused to continue. It refused again after a recalibration and a third attempt. Ocana-Santero could not talk it round and had to fix the code by hand.

The agent was right: manual adjustments during an earlier pause had thrown off the coordinate system. The surgery, expected to take about 45 minutes, ran to just over an hour. Ocana-Santero called it a “frustrating experience but also revealing how much we can come to depend on these models.”

Two larger Claude models would not do the live procedure at all. Claude Opus 5 refused, saying it could not guarantee it would finish and that stopping midway would be worse than not starting; Opus 5.5 also declined to guide the needle into the brain, according to accounts of the test. Only Sonnet 5 agreed to do it start to finish. Anthropic has not commented publicly.

Ocana-Santero says the mouse recovered well. Whether the therapy actually reduces its seizures is still being measured, and a technical report is promised.

Our take: what is real and what is hype

The real part: an AI system chose a treatment, a target and a dose from the scientific literature and delivered it to a living animal under supervision. Ocana-Santero says he knows of no earlier case. That is a genuine step for lab automation, where drug discovery is slow and expensive.

The hype part: this was one mouse, with a vet, a surgeon and hard-coded safety limits around the AI. Nobody is letting a chatbot operate on people. Headlines calling it “AI brain surgery” skip over who held the scalpel and the stop button.

The most interesting detail is the refusal. An agent that stops when its numbers don’t add up is what safety researchers want, but it also shows how hard it is to override a machine once people start relying on it.

What it means for Pakistan

For Pakistani students in biology, pharmacy and computer science, the lesson is that the next jobs are in between: people who understand both lab work and how to set limits on AI agents. Research labs here with small budgets could gain the most from tools that read papers and plan experiments, but they will need the same thing Exin had: clear rules about what the AI may and may not touch. Watch for the technical report and any independent attempt to repeat the result.