What did the AI agent actually do?
The procedure took place on the night before Gabriel Ocana-Santero posted about it on 28 October. Ocana-Santero is co-founder and chief executive of Exin Therapeutics, a San Francisco startup that uses AI to analyse brain activity and develop drugs for epilepsy and neurodegenerative disease. He described the experiment in a thread on X, and WIRED interviewed him about it on 31 October.
The hardware was not an off-the-shelf surgical robot. It was a custom motorised rig built on an Arduino board, with stereotaxic arms that hold and drive an injection needle, plus a camera aimed at the surgical field. The agent could request camera frames whenever it wanted, and it did so 32 times during the session.
The task was framed as a treatment search. Exin gave the agent a spreadsheet of 19 gene therapy vectors, a mouse model of epilepsy, and one objective: reduce seizures. The agent then chose the therapy, the brain region, the injection coordinates and the delivery parameters, according to Ocana-Santero and the outlets that reported the thread.
A human surgeon opened the mouse's skull, a step the agent was not permitted to perform. The agent watched that craniotomy, then drove the needle into the brain and injected 250 nanolitres of the chosen vector over five minutes, according to India Today. A licensed veterinarian approved every irreversible step and held a physical switch that would cut power to every motor.
- •Therapy choice: a vector intended to increase signalling by GABA, the brain's main inhibitory neurotransmitter, under a promoter that restricts where the gene is expressed.
- •Target choice: a region the literature identifies as the origin of this seizure type; the agent rejected a second candidate region and gave reasons.
- •Coordinates: derived from three scientific papers, cross-checked and averaged, according to The Decoder.
- •Execution: the agent set injection volume, speed and wait times, then monitored the entry site through the camera for bleeding.
Which Claude model carried out the injection?
The agent that completed the live procedure ran on Anthropic's Claude Sonnet 5. Getting there took three models. Ocana-Santero wrote in his thread that Claude Opus 5.5 refused immediately once it detected that the work was biological. WIRED reports that the team first tested Opus 5.5 and that it would not guide the needle into the brain, warning it might stop partway through surgery.
Ocana-Santero told WIRED that the model handled the experimental planning but balked at the injection itself: "Something on my output is telling me I shouldn't do this." The Decoder, citing the same thread, reports that Opus 5.5 and Opus 5 both declined, leaving Sonnet 5 as the only model willing to run the live procedure from start to finish.
Opus 5 behaved differently again. According to the thread, it ran an entire dry run on water and graph paper, then stopped at the start of the live surgery. Ocana-Santero quoted its reasoning as beginning with a blunt line: "The block isn't the rig and isn't the inputs. It's me." Anthropic did not respond to WIRED's request for comment.
The model split matters for two reasons. It shows that safety training can produce refusals in the middle of a tightly supervised, legitimate research task. It also shows that a lab cannot assume a more capable model will be the one that agrees to act. WIRED notes Anthropic describes Opus as a heavy-reasoning specialist and Sonnet as better suited to everyday tasks, a distinction that says little about which model will agree to a live brain injection.
Why did the agent refuse to continue mid-surgery?
The procedure did not run smoothly. A connection dropped, and when the agent recalculated, it found that its target position fell outside the rig's physical range of motion. It refused to continue. A calibration restart did not change its assessment, and a third attempt produced the same answer.
The agent was right. Manual adjustments made during an earlier pause had thrown off the control system, according to The Decoder. The refusal was not a glitch in the model's understanding of the task but a correct reading of a machine that had drifted out of alignment.
WIRED describes the same episode slightly differently. It reports that a technical glitch disrupted the equipment's coordinate system, that the agent recognised the calculated position was wrong, and that it would not modify the code to correct the problem because its instructions explicitly prohibited doing so. Either way, the standoff delayed the operation. A typical injection of this kind takes about 45 minutes; this one ran slightly longer than an hour.
The published accounts also differ on how the code was fixed. WIRED reports that a separate Opus 5 agent made the necessary changes without being told a live surgery was under way. The Decoder reports that Ocana-Santero ultimately fixed the code by hand. Both versions describe the same friction: the safety rules that stopped the agent from acting also stopped it from repairing the setup.
India Today's account, published on 30 October, matches the core sequence. It reports that the agent declined to move the needle when it detected the rig was badly positioned, declined again when asked to retry, and that the team later found a calibration fault. That write-up supports the shape of the episode, though all three published accounts still trace back to the same source thread.
Ocana-Santero described the experience as frustrating but revealing, and said it showed how much a lab can come to depend on a model. He singled out "what happens when they just say 'no' in the middle of a time-sensitive procedure."
How much of the procedure was actually autonomous?
The word autonomy needs narrowing. A human surgeon opened the skull and closed the wound. A licensed veterinarian gated every irreversible step. The rig had fixed validators, such as a cap on injection volume, that the agent was forbidden to bypass. Human approval was bound to a specific plan, and a physical emergency stop could cut power to every motor.
Humans also defined the decision space. Exin selected the 19 vectors, chose the mouse model and set the goal. The agent then made the scientific and spatial choices inside that envelope: which vector, which region, which coordinates, what volume and speed. That is broader than following a step-by-step protocol, but narrower than designing an experiment from scratch.
The distinction from existing surgical robots is real. Ocana-Santero acknowledged in his thread that autonomous surgical robots already exist and are better at the mechanics than his bench rig. In those systems, however, a human decides what operation to perform and the robot executes it. Here the agent chose the treatment and the target as well as carrying out the injection.
The agent was not operating blind. The camera let it pull frames on demand, and its 32 observations included watching the surgeon perform the craniotomy and checking the injection site for bleeding. It reported when a portion of the dose had gone in and whether it saw backflow. Those checks are the reason the session reads as a supervised experiment rather than a scripted demo.
Is this really the first AI agent to operate on a live mammal?
That claim comes from Ocana-Santero, not from an independent body. "I am not aware of an agent previously choosing a treatment and a brain target and then delivering it into a living mammal," he wrote in the thread. WIRED does not repeat the first claim as established fact, and The Decoder attributes it to him. India Today describes the work as an early demonstration rather than an approved procedure.
The claim is plausible but unverified. The public thread does not compare the result with earlier animal-robotics work, and no independent audit of the video or machine logs has been published. The results have not been peer reviewed, and a technical report is expected to follow, according to The Decoder.
The definitions also do the heavy lifting. If "operate" means the full surgical sequence, a human opened and closed the skull. If it means choosing a treatment and delivering it, the claim is stronger. The sources do not pin down how earlier work should be counted.
What would settle it is documentation: timestamped machine logs, the full camera record, measured injection accuracy against the planned coordinates, veterinary records and the technical report. Until those are public, the safe reading is that Exin ran an unusual and well-instrumented demonstration, not that it established a scientific first.
What does this mean for lab automation?
The experiment lands in the middle of a push to standardise how agents touch lab equipment. Anthropic opened a research preview of its Model Hardware Standard on 27 August 2026, developed with HHMI Janelia Research Campus. The specification gives agents a common driver for microscopes, liquid handlers and robotic arms, and it is model-agnostic: any agent harness can reach devices through MCP, a command line or code files.
Anthropic says the standard cuts integration work from weeks or months to hours or minutes, and it includes device characteristics and enforced safety limits that an agent can read before acting. Early partners report concrete results. Genentech tested it on a protein assay spanning a liquid handler, robotic arm and plate reader. Carnegie Mellon ran dose-response experiments about three times faster. QuEra gave an agent control of laser stabilisation and reported it recovered the laser lock 99.3% of the time without human intervention. Janelia unified a microscopy rig that had involved seven vendor programs.
Hardware makers are building support. Anthropic lists AWS, QIAGEN, Danaher, Doosan Robotics, MBF Bioscience and Automata among partners working on MHS-enabled equipment. The preview is aimed partly at building safety evaluations and best practices before the standard becomes open source.
Access is gated. Anthropic is sharing the preview with a first group of scientific labs and manufacturers and asks others to apply. It says agents can reason through each experimental step, adjust parameters in real time and, in some cases, recover from hardware errors without intervention. That last capability is exactly what the mouse session strained: recovery depended on a human dealing with a misaligned rig after the agent correctly refused to proceed.
Exin's rig is not an MHS deployment. Ocana-Santero said the team exposed the camera and motor capabilities through its own custom software on an Arduino build. The direction is the same, though. As agents move from analysing data to operating instruments, the questions shift from model accuracy to permissions, audit trails, emergency stops and who signs off on an irreversible action.
That is why the refusals are as instructive as the injection. A lab that wires an agent to a needle needs a system that can say no, explain why, and hand control back to a human without losing the experiment. The mouse session tested all three.
What are the limits, and what should we watch next?
The evidence base is one animal, one session and one company's account. The team has not reported whether the injection reduced seizures; WIRED says it is waiting for the therapy to take effect. There are no published figures for targeting accuracy, tissue damage or bleeding, and no control arm. Exin has an obvious interest in presenting the work as a milestone, and the founder wrote the thread the next day, by his own account after 18 hours at his laptop.
Oversight is also thin in the public record. None of the three published accounts names the animal-ethics approval or licence under which the procedure ran, and the accounts do not say where it took place. Exin is based in San Francisco; Ocana-Santero is a PhD student at the University of Oxford, according to The Decoder. In the UK, procedures on protected animals require a Home Office licence under the Animals (Scientific Procedures) Act 1986, and the Home Office publishes compliance guidance for licensees.
The framing deserves the same scrutiny. The headline idea that an AI performed brain surgery compresses a chain that included a human surgeon, a veterinarian with a kill switch, a curated list of 19 options and a human-set objective. "Autonomous" here means the agent chose and executed the injection step within those limits, not that it ran the operation unsupervised.
What to watch next is concrete. The technical report should show the injection plan, the coordinate maths, the camera record and the veterinary notes. The seizure readout will show whether the therapy choice was any good, which is a separate question from whether the needle moved correctly. Ocana-Santero says the team is testing Grok and other models and experimenting with agent-controlled craniotomies, with safety checks before any live attempt.
The wider test is institutional. Journals, funders and animal-welfare committees will need a view on how AI-chosen procedures are disclosed and reviewed. Anthropic's MHS preview is trying to write safety practice before adoption hardens. Exin's mouse is a vivid data point in that process, not the end of it. Ocana-Santero also says a mistake at the craniotomy stage could seriously harm the animal, and that it is far too soon to point an agent at a human brain.