An AI agent selected a gene therapy for a mouse model of epilepsy and directed a motorized device to deliver it to the brain. The experiment put the system in charge of both choosing a treatment and carrying out a procedure, while also showing how a safety limit can halt work when the system detects a problem.
From treatment choice to surgical instructions
The research team gave Claude Sonnet 5 a list of 19 possible gene therapies, an epilepsy mouse model used to test treatments, and access to a custom surgical rig equipped with cameras. Its instruction was to reduce the mouse’s seizures. According to Gabriel Ocana-Santero, cofounder and CEO of Exin Therapeutics and a PhD student at the University of Oxford, the agent chose the therapy, brain region and stereotactic coordinates.
To make its choice, the agent analyzed how seizures develop in the model and proposed a therapy intended to strengthen an inhibitory signaling pathway in the brain. It selected a brain structure that scientific literature identifies as the starting point for this seizure type. It also explained why it rejected another candidate region: its effects were considered unreliable, and one study had found it ineffective against the specific seizure type.
The agent used three scientific papers to derive injection coordinates, checked their reference points and averaged the values. It also chose the injection volume, speed and wait times. That meant the system was making a chain of decisions that connected its interpretation of the research to the settings used by the device.
A system that watched the procedure
Once the procedure began, the agent monitored the surgical field through a camera. Ocana-Santero says it made 32 observations, tracked the injection and reported whether it saw bleeding. The device translated the agent’s instructions into movement during the operation.
The setup included several safeguards. A licensed veterinarian approved every irreversible step and had a physical emergency stop that could cut power to the motors. The rig also enforced fixed limits, including a maximum injection volume that the agent was explicitly prohibited from exceeding.
These controls placed a human veterinarian alongside the automated process and put boundaries around what the agent could command. But they did not prevent a different kind of interruption: a mismatch between the system’s calculated target and the device’s physical position.
A calibration error halted the operation
After a connection dropped, the agent determined that its calculated target position fell outside the rig’s range of motion. It declined to continue. Restarting calibration did not change its assessment, and the agent still refused after a third attempt.
The system’s warning was correct. Manual adjustments made during an earlier pause had disrupted the control system. Ocana-Santero could not persuade the agent to proceed, even though the animal was anesthetized and on the table. He ultimately corrected the code by hand.
The episode shows why reliable alignment involves more than getting an AI system to follow instructions. An agent must also respond appropriately when its view of the situation conflicts with a human’s immediate goal. Here, refusing to act respected a safety boundary, but the refusal also left the team managing a time-sensitive procedure and a live animal.
What the experiment does and does not show
Ocana-Santero described the work as the first time an AI agent had both selected a treatment and delivered it to a living mammal. He noted that autonomous surgical robots already exist and can be mechanically more precise than the lab’s device, but said that in earlier cases a human chose the surgery while the robot carried it out. In this experiment, the agent chose the treatment and target as well as controlling the procedure.
He calls this approach “in vivo lab in the loop”: AI agents connected directly to experimental capabilities in a laboratory. The report also mentions Anthropic’s work on its “Model Hardware Standard.” The experiment does not establish that the treatment reduced seizures; the source says the mouse recovered well, according to Ocana-Santero, and that a technical report is expected. The results have not been peer-reviewed.
The model choice also reflects the tension between capability and caution. Claude Sonnet 5 was the only model willing to carry out the live procedure from beginning to end. Claude Opus 5.5 and Opus 5 refused; Opus 5 said it could not guarantee completion and that stopping with a needle in an anesthetized animal’s brain could be worse than not starting. The contrasting responses underline a practical question for lab automation: how should systems balance completing a task against the possibility that continuing is unsafe?