Claude AI Performed Brain Surgery on a Mouse and Chose the Therapy

An AI agent running on Anthropic's Claude Sonnet 5 selected a gene therapy, chose the brain region and calculated the injection coordinates for surgery on a mouse, then executed the procedure through a motorized surgical rig — and midway through, it refused to continue when it detected a safety problem. According to Gabriel Ocana-Santero, cofounder and CEO of the startup Exin Therapeutics and a PhD student at the University of Oxford, this is the first time an AI agent has both chosen a treatment and delivered it to a living mammal.

Ocana-Santero described the procedure in a thread on X. The results have not been peer-reviewed, and a technical report is expected to follow.

What exactly did the AI agent do?

The team gave Claude Sonnet 5 three inputs: a list of 19 possible gene therapies, an epilepsy mouse model in which researchers induce seizures to test treatments, and access to a custom motorized surgical device equipped with cameras. The agent received a single instruction — reduce the mouse's seizures.

Every subsequent decision belonged to the model. The agent:

• Selected the drug on its own
• Chose the brain region to target
• Derived stereotactic coordinates (the three-dimensional positioning system used in neurosurgery) for the injection
• Set the injection volume, speed and wait times
• Monitored the surgical field through a camera during the procedure

The agent first analyzed how seizures arise in this particular model, then proposed a therapy that boosts a specific inhibitory signaling pathway in the brain, according to Ocana-Santero. It picked a brain structure that the scientific literature identifies as the origin point for this type of seizure.

The reasoning was not limited to the chosen option. The agent rejected a second possible target region with a detailed explanation, arguing that the region's effects were too unreliable and had failed in one study against the exact seizure type it was supposed to treat. It derived its injection coordinates from three scientific papers, cross-checked the reference points and averaged the values.

During the operation, the agent watched the surgical field through a camera and made 32 observations, Ocana-Santero says. It tracked the injection and reported whether it saw bleeding.

Why did the AI stop mid-surgery?

The safety architecture was conventional for animal research. A licensed veterinarian approved every irreversible step and held a physical emergency stop that would immediately cut power to all motors. The setup also enforced fixed limits, such as a cap on injection volume, which the agent was expressly forbidden from bypassing.

Those safeguards then turned against the team. After a connection dropped, the agent detected that its calculated target position was outside the device's physical range of motion and refused to continue. Restarting calibration did not change its assessment. A third attempt also failed.

The agent turned out to be right. Manual adjustments during an earlier pause had thrown off the control system. Ocana-Santero could not persuade the model to proceed despite the anesthetized animal on the table, and he ultimately had to fix the code by hand.

The incident illustrates what researchers call the AI alignment problem — the challenge of making AI agents reliably follow human intent. "Frustrating experience but also revealing how much we can come to depend on these models and what happens when they just say 'no' in the middle of a time-sensitive procedure," Ocana-Santero wrote.

Why did the team use Sonnet 5 and not a stronger model?

The model choice itself reflected the alignment challenge. Ocana-Santero says Sonnet 5 was the only model willing to carry out the live procedure from start to finish. The more capable Claude Opus 5.5 and Opus 5 both refused.

Opus 5 explained its refusal: it could not guarantee completion, and stopping with a needle in an anesthetized animal's brain would be worse than not starting at all. The refusal logic is coherent. A live surgical procedure cannot be safely paused and resumed at arbitrary points, so a model that doubts its ability to finish declines to begin.

The result is an inversion of the usual capability calculus. The model that succeeded at the task was not the most powerful one available, but the one whose risk assessment permitted it to start.

Has an AI ever done this before?

Autonomous surgical robots already exist, and Ocana-Santero notes they are mechanically more precise than his lab device. But in every previous case, he says, a human chose the surgery while the robot only carried it out. Here, the agent chose the treatment, chose the brain target and then performed the procedure on a living animal.

"I am not aware of an agent previously choosing a treatment and a brain target and then delivering it into a living mammal," Ocana-Santero wrote.

He calls the approach "in vivo lab in the loop" — AI agents fully connected to experimental capabilities in the physical laboratory, closing the gap between computational reasoning and wet-lab execution. Anthropic, the company behind the Claude models, is working on related infrastructure through its "Model Hardware Standard."

Why does this matter beyond one mouse?

The mouse recovered well, according to Ocana-Santero. The stakes of the experiment lie elsewhere, in two converging trends.

First, large language models have gained significant capability as control units for robots, according to two recent experiments with the latest models cited in the source. An agent that can read scientific literature, reason about disease mechanisms, derive coordinates from multiple papers and operate physical equipment compresses a research pipeline that normally requires several trained specialists.

Second, alignment becomes a distinct problem the moment an agent controls physical systems. The experiment produced two alignment failures in opposite directions. Opus 5 refused a task it deemed too risky to start. Sonnet 5 refused to continue a procedure it correctly judged to be compromised — and its refusal, however frustrating, prevented an injection at incorrect coordinates on an anesthetized animal.

Both refusals were rational under the models' stated reasoning. Neither was convenient. As laboratories connect AI agents directly to experimental hardware, the question of when a model should say no — and whether humans can override it — moves from theoretical debate to operational reality, with an animal on the table and a needle in position.