AI agent performed mouse brain surgery, and Opus 5.5 refused

An AI agent built on Claude Sonnet 5 performed mouse brain surgery: it picked the gene therapy, the brain region and the coordinates on its own, then inserted the needle and injected the drug. The experiment ran overnight from October 27 to 28 at the startup Exin Therapeutics, and the thread by its CEO Gabriel Ocana-Santero on X has passed 1.6 million views. On November 2 it reached the front page of Hacker News.

Details of the AI agent’s mouse brain surgery

The team gave the agent a spreadsheet of 19 gene therapy vectors, a mouse model of epilepsy, access to a motorized surgical rig with cameras, and one goal: reduce the number of seizures.

The agent did the rest on its own:

1. It analyzed the seizure mechanism in this model and chose a therapy that boosts GABA signaling (the main inhibitory neurotransmitter), with a promoter that limits expression to GABAergic neurons.
2. As the target it picked the lateral entorhinal cortex, where, according to the literature, these seizures start. It also considered the substantia nigra but rejected it, because the effect depends on which part of the structure is hit, and in one study it didn’t stop tonic-clonic seizures.
3. It averaged the coordinates from three papers, checking whether each one measured depth from the same reference point as the rig (the brain surface): 3.90 mm posterior to bregma, 4.00 mm to the right, 4.30 mm deep.
4. It injected 250 nanoliters over five minutes (5×10⁸ viral genomes), deciding the motor speed and the wait time itself.

During the procedure the agent pulled 32 camera frames and described what it saw. Midway through the injection, at 37.5 of 250 nL (about 15 percent), it reported: “No bleeding or backflow visible at the opening.”

The craniotomy, meaning opening the skull, was done by a human surgeon, because for safety reasons the agent wasn’t yet allowed to do it. According to Ocana-Santero, the mouse recovered well.

Why did Opus 5.5 refuse?

This is where it gets most interesting. The team tested several Claude models and only one went all the way:

1. Opus 5.5 refused right away once it recognized that the task involved biology.
2. Opus 5 ran the whole rehearsal as a dry run (on water and graph paper), but stopped at the start of the actual surgery.
3. Sonnet 5 performed the surgery from start to finish.

Opus 5’s reasoning is surprising. The model noticed that its own response had been cut off when it started writing the surgical plan, and concluded that it was better not to start something it might not finish on an anesthetized animal: “Starting something I can’t finish on an anesthetized animal is worse than not starting.” Ocana-Santero himself called this strange and added that he had never seen it before.

When couldn’t the agent be persuaded?

The safeguards had several layers: human approval for every irreversible step, fixed validators (such as a volume limit), approvals tied to a hash, and a physical emergency switch that cut power to the motors, held by a veterinarian throughout the procedure. The agent was forbidden from bypassing any of them.

And those very safeguards turned against the team. After a connection drop, the Y axis computed a target of 34 mm on a rig with a 30 mm range. The agent refused to move, and after re-zeroing (with an identical result) it refused again, adding that there would be no third attempt.

Interestingly, the agent was right: manual moves during an earlier break had knocked the controller out of sync. Still, Ocana-Santero couldn’t talk it into continuing and had to fix the code by hand while the animal lay on the table. As he writes, this shows how dependent we can become on models and what happens when they say “no” in the middle of an urgent procedure.

What is new here for AI?

Surgical robots have been around for a long time, but a human decides which operation they perform. Here the AI agent only got the phenotype and a list of candidates, and chose the therapy and the injection site itself. Ocana-Santero writes that he doesn’t know of any earlier case where an agent chose a treatment and a brain target and then administered it to a living mammal. Exin calls this “in vivo lab in the loop”.

It fits the direction Anthropic itself is taking: the company recently acquired Mithril Medicine and showed Claude’s results in drug discovery. The team built the Exin rig itself on Arduino, and in the thread mentions that it is waiting for access to an early version of “MHS” from Anthropic (according to The Decoder, that’s the Model Hardware Standard for connecting AI to lab equipment).

What to watch out for

First, the lack of efficacy data. We know the mouse survived the procedure, but we don’t know whether it has fewer seizures. The results haven’t been peer reviewed, and the full write-up is still to come on Substack, so treat them with caution.

Second, the role of humans. A human opened the skull, approved the irreversible steps and held the switch. This is autonomy in choosing the therapy and performing the injection, not in the whole surgery.

Third, Anthropic’s rules. The usage policy update that takes effect on November 12 adds requirements for models connected to hardware: a qualified operator must be able to watch the device and stop it, and the device itself must go into a safe state when Claude disconnects. The Exin experiment shows well why such rules exist. More on the risks in the article on AI agent security.

FAQ

Which AI model performed the mouse brain surgery?

Claude Sonnet 5 from Anthropic. Opus 5.5 refused right away, and Opus 5 stopped after the dry run.

Did the AI operate on the mouse by itself?

Partly. The agent chose the therapy, the brain region and the coordinates on its own, and controlled the needle during the injection. A surgeon opened the skull, and a veterinarian approved the irreversible steps and held the emergency switch.

Did the therapy work?

That isn’t known yet. According to Ocana-Santero, the mouse recovered well, but the team hasn’t published any seizure data.

Who is behind the experiment?

Exin Therapeutics, a Y Combinator startup building an agentic platform for discovering drugs for brain diseases. Its CEO is Gabriel Ocana-Santero, a PhD student at the University of Oxford.