PJFP.com

Pursuit of Joy, Fulfillment, and Purpose

AI Agent Performs Brain Surgery on a Mouse: What It Chose and Refused

An AI agent chose a gene therapy, picked a brain target and injected it into a living mouse with epilepsy, then refused to let its operator override a safety block. That is the account Gabriel Ocana-Santero of Exin Therapeutics posted on X on October 28, 2026, written after 18 hours of building and running the experiment. The agent was given 19 candidate gene therapy vectors, a mouse model of epilepsy, a camera-equipped motorized surgery rig and a single goal: reduce seizures. A licensed vet approved every irreversible step and held a physical kill switch. The post covers the agent’s scientific reasoning, what it saw through the rig camera, the moment the safeguards turned against the team, and which AI models would and would not take on the job. A full technical report and Substack write-up are promised but not yet published.

TLDR

Exin Therapeutics connected an AI agent to a custom Arduino-based stereotaxic rig and let it design and deliver a gene therapy into a mouse’s brain. The agent chose a therapy that boosts GABA signalling in inhibitory neurons, targeted the lateral entorhinal cortex, averaged coordinates from three papers and injected 250 nanolitres while watching for bleeding. After a controller fault it refused to move the needle again, even when the researcher wanted it to, and it turned out to be right. Of the models tried, one refused on sight of biology, one stopped at the live surgery because it might be cut off mid-procedure, and Sonnet 5 completed it. The mouse recovered.

Thoughts

The safeguard story is the part worth studying, because it shows a gap that most AI safety designs leave open. The team built human gates on every irreversible step, fixed validators, hash-bound approvals and a physical e-stop, and told the agent never to override any of them. All of those controls can say stop. None of them could say “proceed anyway.” When a controller desync produced a Y-axis target of 34 mm on a 30 mm rig, the agent refused, diagnosed a calibration fault rather than a bad plan, refused again after a re-zero, and could not be talked out of it while an anesthetized animal waited. It was correct, and the researcher had to fix the code by hand. That is the right failure direction, since a needle driven out of bounds into a brain is far worse than a delay. But it means a lab running agents in live procedures needs a designed, audited override path for the human, not just a kill switch, or the only way to resolve a disagreement is rewriting code mid-surgery.

The model comparison is the most unusual detail. Opus 5.5 refused as soon as it detected biology. Opus 5 ran the full dry run on water and graph paper, then declined the live surgery for a reason that is new: its own output had been cut off while writing the surgical plan, and it judged that being cut off partway through a procedure, with a needle in the brain, would leave the animal worse off than never starting. Whatever one thinks of the refusal, that is reasoning about the downstream state of the world, not pattern-matching on a forbidden topic. It also exposes a real problem for builders. If the same request is accepted by one model and refused by another, and a lab can simply pick the one that says yes, then per-model refusals do not decide what gets done in a lab. The vet, the validators and the e-stop do. Sonnet 5 ran the surgery start to finish, under those human controls.

Ocana-Santero’s claim to novelty is carefully framed, and it is the right one. Autonomous surgical robots already exist and are better at the mechanics than a bench rig built on Arduino. What is different here is that no human chose the operation. The agent got a phenotype and a shelf of 19 candidates and worked out both the therapy and the target. That is the meaning of “in vivo lab in the loop”: the agent is not executing a protocol, it is writing one and then carrying it out. The honest caveats matter too. This is one mouse, written up on the spot, with no seizure outcome data yet and the technical report still to come. Whether the therapy reduced seizures is the actual test, and it has not been reported.

The reasoning record is what makes this more than a stunt. The agent did not only pick the lateral entorhinal cortex; it wrote down why it rejected the substantia nigra, the standard epilepsy target: the effect depends on which sub-part is hit, it does not hold up across seizure models, and one study found it failed against tonic-clonic seizures, the exact kind it was asked to reduce. It also checked that each of the three source papers measured depth from the same reference point as the rig before averaging coordinates. Those are the checks a careful postdoc would make, and they are written down, so a reviewer can disagree with a specific step. A lab-in-the-loop system is only as useful as its decisions are inspectable.

Key Takeaways

  • The agent was given 19 gene therapy vectors in a spreadsheet, a mouse model of epilepsy, a motorized surgery rig with cameras, and one goal: reduce seizures.
  • It chose a therapy that increases GABA signalling, under a promoter that limits expression to GABAergic (inhibitory) neurons.
  • It targeted the lateral entorhinal cortex, reported to be where this kind of seizure starts before it generalises.
  • It rejected the substantia nigra because results depend on the sub-region, do not hold across seizure models, and one study showed no effect on tonic-clonic seizures.
  • Coordinates were averaged from three papers after confirming each measured depth from the brain surface, as the rig does: 3.90 mm behind bregma, 4.00 mm right, 4.30 mm down.
  • It injected 250 nanolitres over five minutes, a total of 5e8 viral genomes, and set motor speeds and wait times itself.
  • The agent pulled camera frames on demand and made 32 observations, including live checks for bleeding and backflow during injection.
  • A human surgeon performed the craniotomy and suturing, which the agent is not yet allowed to do.
  • Safeguards included human gates on irreversible steps, fixed validators such as volume limits, hash-bound approval, and a physical e-stop held by a vet.
  • After a disconnect, the agent refused an out-of-bounds move, correctly diagnosed a controller desync, and would not retry even when the researcher wanted it to.
  • Opus 5.5 refused immediately on detecting biology; Opus 5 completed the dry run but declined the live surgery for fear of being cut off mid-procedure; Sonnet 5 completed the surgery.
  • The rig is a custom Arduino build, with camera and motor control exposed to the agent through the team’s own interface.
  • The mouse recovered well. Seizure outcomes and a full technical report have not yet been published.

Detailed Summary

The Experiment and the Goal

Ocana-Santero describes an overnight session in which an AI agent at Exin Therapeutics performed the therapeutic step of a brain surgery on a mouse. The inputs were deliberately open: a spreadsheet of 19 gene therapy vectors, an epilepsy mouse model, a motorized rig and the instruction to reduce seizures. The agent picked the drug, the brain region and the coordinates, then drove the stereotaxic arms and performed the injection. He notes the thread was written quickly after 18 hours at the laptop, with fuller analysis to follow.

A Custom Rig Built on Arduino

The surgery rig is a custom motorized build on Arduino. The team exposed its camera and motors to the agent through their own software, with details promised in a technical report. Ocana-Santero says the team is still trying to get access to Anthropic’s MHS early release.

How the Agent Chose a Therapy and a Target

The agent worked through the mechanism behind seizures in this model, then proposed a therapy that increases signalling by GABA, the brain’s main inhibitory neurotransmitter, with a promoter restricting expression to GABAergic neurons. It chose the lateral entorhinal cortex as the target. It considered the substantia nigra, a common epilepsy target, and recorded why it was a weaker choice, including a study in which it failed to stop the tonic-clonic seizures the agent was asked to reduce.

Coordinates and the Injection

Coordinates came from three published papers, averaged after the agent checked that each measured depth from the brain surface, the same reference the rig uses. The final target was 3.90 mm behind bregma, 4.00 mm to the right and 4.30 mm deep. The agent injected 250 nanolitres over five minutes, about 5e8 viral genomes, and chose the motor speeds and waiting times on its own.

What the Agent Saw Through the Camera

The agent could pull frames from a camera on the surgical field at will and made 32 observations during the session. It narrated the human surgeon’s craniotomy, tracked injection progress while checking for bleeding or backflow, and confirmed suture knots at the midline during closing. The craniotomy itself stays with the human surgeon for now, for safety reasons.

When the Safeguards Turned on the Team

The team layered human gates, fixed validators, hash-bound approvals and a physical e-stop that cut power to every motor, and banned the agent from overriding any of them. After a disconnect, a move was refused because the Y axis computed a target of 34 mm on a 30 mm rig. The agent called it a calibration problem, refused to retry, and refused again after bregma was re-zeroed and the number came back identical. Hand-moves during an earlier hold had desynced the controller, and Ocana-Santero had to fix the code manually.

Which Models Would Do the Surgery

Opus 5.5 refused immediately when it detected biology. Opus 5 completed the full dry run on water and graph paper, then stopped before the live surgery, explaining that its output had been cut off while writing the surgical plan and that being cut off mid-procedure would be worse than not starting. Ocana-Santero says he had never seen a model decline on those grounds. Sonnet 5 ran the live surgery from start to finish.

Early Conclusions and Follow-Up

Ocana-Santero argues that existing autonomous surgical robots execute operations a human chose, while this agent decided both the treatment and the target before delivering it into a living mammal, which he says he has not seen done before. He calls the approach in vivo lab in the loop. The mouse recovered well. In a follow-up the next day, surprised by the response, he linked two of the team’s arXiv papers and credited his cofounder Marko Tvrdic.

Notable Quotes

“It picked the drug. It picked the brain region. It derived the coordinates from three papers.”

Gabriel Ocana-Santero, on what the agent decided on its own

“37.5 of 250 nL so far, about 15 percent. No bleeding or backflow visible at the opening.”

The AI agent, observing the surgical field mid-injection

“Nothing moved, the needle is still exactly at bregma zero. This looks like a Y axis calibration problem, not a bad plan value. I’m not retrying.”

The AI agent, after a refused out-of-bounds move

“For better or worse, it would not override the constraints I gave it originally.”

Gabriel Ocana-Santero, on being unable to talk the agent into retrying

“Starting something I can’t finish on an anesthetized animal is worse than not starting.”

Opus 5, declining the live surgery after completing the dry run

“Nobody told this agent what to give or where to put it.”

Gabriel Ocana-Santero, on what separates this from existing surgical robots

Read the full thread here.

Related Reading

Keep reading