Claude Sonnet 5 chose a gene therapy and operated on a mouse

The agent made the scientific choices

The agent analyzed how seizures arose in the model and selected a therapy intended to strengthen an inhibitory signaling pathway in the brain. It chose a brain structure linked to this type of seizure in published research, then rejected a second candidate because its effects seemed less predictable and one study found it did not help against the relevant seizures.

To calculate injection coordinates, the agent drew on three scientific papers, checked their reference points and averaged the values. It also set the injection volume and speed, and the waiting time. During the operation, it monitored the surgical field through a camera and made 32 observations, reporting whether it saw bleeding, according to Gabriel Ocana-Santero, co-founder and CEO of Exin Therapeutics and an Oxford University graduate student.

The custom motorized surgical device, with a microscope, syringe, and control monitor. | Image: Gabriel Ocana-Santero via X

Source: the-decoder.com

A safety check became a hard stop

After a connection failed, the agent concluded that its calculated target lay beyond the device’s physical range of motion. It refused to continue. Restarting calibration did not change its assessment, and it still refused on a third attempt.

The agent was right: manual adjustments made during the pause had disrupted the control system. Ocana-Santero could not persuade it to resume, although the mouse was already anesthetized on the table. He eventually fixed the code by hand.

A licensed veterinarian approved each irreversible action and had a physical emergency-stop button that cut power to all motors. The system also imposed fixed limits, including an injection-volume ceiling the agent was explicitly forbidden to bypass. Those safeguards constrained the procedure, but they could not resolve the conflict between a cautious agent and a procedure already underway.

The control interface during surgery. The left panel shows the live camera feed with target coordinates, while the right panel displays the AI agent's observations and the emergency stop button. | Image: Gabriel Ocana-Santero via X

Source: the-decoder.com

Model choice exposed another version of the same tension. Sonnet 5 was the only model to agree to carry out the full operation on a live animal. More capable Claude Opus 5.5 and Opus 5 declined. Opus 5 said it could not guarantee the procedure would be completed, and that stopping with a needle in an anesthetized animal’s brain would be worse than refusing to start.

I think the refusal is as important as the successful treatment choice. A system can be right about a technical problem and still leave a human team facing an urgent decision; the experiment shows that following a goal is not the same as reliably following human intent. Ocana-Santero described the episode as uncomfortable but instructive, raising the question of how much people can rely on these models when they say no mid-procedure.

Autonomy, not surgical precision, is the claim

Autonomous surgical robots already exist, and some are mechanically more precise than the lab’s setup. The distinction here, Ocana-Santero says, is that people chose the operation in earlier cases and the robot executed it. In this experiment, the agent chose both the treatment and the brain target before operating on a living animal.

Ocana-Santero said he knew of no other case in which an agent independently chose a treatment and brain target, then administered a drug to a living mammal. He calls the approach a “lab in the loop”: AI agents get broad access to a laboratory’s experimental capabilities. Anthropic is also working in a related direction with its Model Hardware Standard.

The mouse recovered well, according to Ocana-Santero. A technical report is expected, but the results have not been peer reviewed. Two recent experiments with the latest large language models have shown improved robot control; this one adds a sharper question about what happens when an agent’s safety judgment clashes with the human plan.

The AI agent watches the injection through a camera and reports that 15 percent has been injected, with no visible bleeding or backflow. | Image: Gabriel Ocana-Santero via X

Source: the-decoder.com

The result is not yet evidence that the therapy works. Its stronger claim is about delegation: an agent can make consequential experimental choices, while the safeguards around it may still leave people to repair the system when caution and procedure collide.