Claude Sonnet 5 picked one of 19 gene therapies on its own and performed brain surgery on a mouse

An AI agent built on Claude Sonnet 5 received a list of 19 possible gene therapies, a mouse model of epilepsy and access to a motorized surgical rig. From that list it chose the therapy, the brain target and the injection coordinates itself, then performed surgery on the brain of a live mouse. Gabriel Okana-Santero, co-founder and CEO of the startup Exin Therapeutics and a doctoral student at the University of Oxford, described the experiment in a thread on X. According to him, no agent had previously combined choosing a treatment with delivering it into a live mammal. The results have not been peer-reviewed, and a technical report is promised later.

What the agent received and what it decided on its own

The starting conditions were sparse. Claude Sonnet 5 was given 19 gene therapies to choose from, a mouse model of epilepsy in which seizures are induced artificially to test treatments, and a homemade rig with a microscope, a syringe and cameras. The instruction boiled down to one thing: reduce the number of seizures.

From there the agent worked without hints. It first worked out how seizures arise in this particular model and proposed a therapy that strengthens one of the brain's inhibitory signaling pathways. As the target, it picked a structure that the literature identifies as the point of origin for this type of seizure. It rejected a second candidate region with a detailed rationale: the region's effect is too unstable, and in one study it did not help against the same type of seizure.

The agent derived the stereotaxic coordinates (precise three-dimensional landmarks for the needle) from three scientific papers, cross-checked the reference points and averaged the values. It also set the injection volume, speed and pauses itself. During the operation it watched the field through the camera, made 32 observations and reported, for example, that 15% of the volume had been delivered and that there was no bleeding or backflow.

When the safeguards worked against the team

The constraints were strict. A licensed veterinarian approved every irreversible step and held a physical button that instantly cut power to all motors. There were also fixed limits, such as a ceiling on injection volume, which the agent was explicitly forbidden to bypass.

Those constraints are what stopped the procedure. After a connection dropout, the agent calculated that the target position lay outside the rig's physical range of motion and refused to continue. Restarting the calibration did not change its assessment, and neither did a third attempt. The agent turned out to be right: manual adjustments made during an earlier pause had thrown off the control system's settings. Okana-Santero could not persuade it to continue, even with an anesthetized animal on the table, and ended up fixing the code by hand.

"A disappointing experience, but it shows how dependent we can become on these models and what happens when, in the middle of an urgent procedure, they simply say 'no,'" he wrote. The mouse, he said, recovered well.

Why Sonnet 5 and not the more powerful Opus models

The choice of model also reflected an alignment problem. Sonnet 5 was the only model that agreed to carry out the live procedure from start to finish. The more capable Claude Opus 5.5 and Opus 5 declined. Opus 5 explained that it could not guarantee completion, and that stopping with a needle in the brain of an anesthetized animal is worse than refusing to start. The alignment problem is the question of how to make agents reliably follow human intent; here the model followed its own notion of safety, and that notion did not match the operator's plans.

Okana-Santero adds a caveat: autonomous surgical robots exist and are mechanically more precise than his rig, but in those cases a human chose the operation and the machine only executed it. He calls his approach "in vivo lab in the loop": agents are fully connected to a laboratory's experimental capabilities. According to the outlet, Anthropic is working in the same direction with its "Model Hardware Standard."

What remains in question

The experiment looks like a demonstration of a pipeline, not a scientific result about a therapy. The source contains no data on whether the seizures decreased or how much better the agent's choice was than the alternatives. The account relies on the author's thread, not on a peer-reviewed paper. It is also unknown how many animals and attempts stood behind the demonstration.

The practical takeaway for anyone connecting agents to physical equipment is simple. A hardware emergency stop and hard limits work, but an agent that honestly refuses to go past them can halt a procedure at the most inconvenient moment. Plan a protocol for such a refusal in advance, rather than fixing code by hand while the animal is under anesthesia.