An AI Agent Just Performed Brain Surgery on a Live Mouse, With a Few Caveats

Give an AI agent a robotic arm, an injector, and a live mouse, and apparently it'll do brain surgery. That's not a hypothetical anymore. Gabriel Ocana Santero, CEO and cofounder of Exin Therapeutics, recently ran an experiment where an AI agent carried out a real brain injection procedure on a living mouse, no human hands on the actual delivery. It took some workarounds to get there, but it's a solid early data point for what happens when you stop asking AI to just design experiments on paper and start letting it touch the equipment.

Santero posted about the experiment on social media and told WIRED the motivation was straightforward: he wanted to see what changes when an agent gets direct access to a lab rig instead of being treated as an analyst sitting one step removed from the bench. "We've realized that we need to connect these agents to a lab to get the maximum value from them," he said. Exin, based in San Francisco, uses AI to analyze brain activity for drug development targeting epilepsy and neurodegenerative disease, so this wasn't a stunt disconnected from the company's actual work.

The reasoning behind the experiment is worth sitting with for a second. Most frontier models are trained heavily on published literature, which means they're learning from the clean, finished version of science. They're not seeing the failed runs, the weird real-time judgment calls, the stuff that never makes it into a paper. Santero's bet is that hooking models up to actual experiments, with all their messiness, makes them more reliable collaborators down the line. It's the same logic behind a lot of embodied-AI research: models get smarter about the physical world by actually being in it, not by reading about it.

The setup itself was purpose-built: a motorized rig to immobilize the mouse, a camera feed for the agent to observe the field, and controls for a robotic injection needle, including volume and injection speed. The team was testing a gene therapy aimed at reducing seizures in an epileptic mouse. A veterinary surgeon handled the craniotomy, the actual skull opening, while the AI agent watched. From there, the agent picked the therapy from 19 spreadsheet options, selected the brain region and injection coordinates, and then drove the robotic arm and needle itself.

When the Model Says No

Here's where it got interesting. The team first tried Anthropic's Claude Opus 5.5, a model Anthropic positions as its heavy-reasoning specialist for complex multistep problems. Opus did the experimental planning without issue. But when it came time to actually guide the needle into the mouse's brain, it balked, flagging that it might stop partway through the procedure in a way that could endanger the animal. "He did the experimental planning, but when it was time to inject, he said, 'something on my output is telling me I shouldn't do this,'" Santero said. "That was very interesting."

So the team switched to Claude Sonnet 5, Anthropic's model built more for everyday tasks, which agreed to proceed. There's something almost darkly funny about the more "everyday" model being the one willing to do neurosurgery, but it also tracks with how these systems get tuned: reasoning-heavy models are sometimes built with more conservative safety behavior baked in, especially around irreversible physical actions.

The team wasn't flying blind, either. They built in real safeguards: the AI had to propose an injection plan and get human sign-off before acting, there was a physical kill switch that could cut power to the rig's motors, and the agent's access to the equipment's underlying control code was deliberately restricted so it couldn't rewrite its own operating rules mid-procedure.

That last restriction actually caused the biggest snag. A glitch threw off the rig's coordinate system, and the agent correctly identified that the calculated injection position was wrong. But it refused to fix the code itself, because its instructions explicitly barred it from touching that layer. The team had to bring in a separate Opus 5 instance to make the code correction, deliberately keeping that second agent in the dark about the fact that a live surgery was underway, presumably to avoid triggering the same hesitation Opus 5.5 had shown earlier. The back-and-forth added real time: a typical injection surgery runs about 45 minutes, and this one took a bit over an hour.

This is a sharp example of a problem agentic AI deployments keep running into outside the lab too. Lock an agent down with hard-coded guardrails and you get predictable, safer behavior, but you also lose flexibility the moment something goes sideways. It's the same tension showing up in other recent agent experiments, like AI models being put behind the wheel of a car to fetch fast food, where only one of three tested models actually pulled it off. Autonomy and safety are still fighting each other at the implementation level, not just the policy level.

Santero's team came away impressed despite the friction, and they're planning to test Grok and other models next to see how performance compares. They're also exploring agent-controlled craniotomies, the skull-opening step a human surgeon handled this time around, but Santero's clear that's a much bigger risk and they want certainty on safety before trying it on a live animal. "A mistake at that stage could seriously harm the mouse," he said.

Key Takeaways

• An AI agent (Claude Sonnet 5) controlled a robotic injector to perform a live brain injection on a mouse, after Claude Opus 5.5 refused mid-procedure over safety concerns.
• Human oversight checkpoints, including mandatory plan approval and a physical kill switch, remained central to the setup, and one of those same restrictions caused a delay when the agent couldn't fix its own coordinate error.
• Exin plans to test additional models and is exploring agent-controlled craniotomies next, though full autonomy on that more complex, higher-risk step is still a ways off.
• The mouse is reportedly recovering well, and the team is now waiting to see if the gene therapy reduces seizure activity.