An AI Agent Just Operated on a Mouse

Robots have injected mouse brains before. This time an AI decided what to inject and where, and carried out the injection itself.

The short version: Overnight before October 28, 2026, the neuroscience startup Exin Therapeutics let an AI agent run part of a brain operation on a mouse with epilepsy. Given 19 possible gene therapies and the goal “reduce seizures,” the agent (Anthropic’s Claude Sonnet 5) chose the therapy, chose where in the brain to put it, worked out the coordinates from three papers, and drove a motorized needle to inject 250 nanoliters. A human surgeon opened the skull and closed the wound, and a vet held an emergency stop button the whole time. The company says the mouse recovered well. There is no paper, ethics record or seizure data yet: everything comes from the cofounder’s thread on X.

What happened in the AI mouse surgery?

Gabriel Ocana-Santero, a neuroscientist and cofounder of Exin Therapeutics (a Y Combinator startup from the Winter 2025 batch that works on drugs for brain disorders, starting with epilepsy), posted the story on X on October 28. He wrote it after an 18-hour day, and it has since passed 900,000 views.

Where the story broke. The first post of the thread, October 28, 2026. Read the full thread on X. Screenshot: x.com/OcanaSantero, October 29, 2026.

The setup, in his words: the team gave the agent “19 gene therapy vectors in a spreadsheet, a mouse model of epilepsy, access to a motorize surgery rig with cameras and one goal: reduce seizures.” The rig is homemade, built on Arduino (cheap hobby electronics), with its camera and motors wired up so the AI could use them as tools.

The agent didn’t do the whole operation. A human surgeon opened a small hole in the skull, which the agent “is not allowed to do yet for safety reasons,” and a human closed the wound afterward. The agent handled the planning beforehand and the injection in between.

What did the AI decide on its own?

Words you will meet

Gene therapy vector: A harmless, emptied-out virus used as a delivery truck to carry new genetic instructions into cells.
GABA: The brain’s main “calm down” signal. More of it makes nerve cells less likely to fire.
Stereotaxic rig: A frame that holds an animal’s head still and moves a needle along three measured axes.
Bregma: A point on the skull where two bone plates meet. Brain coordinates are measured from it.
Nanoliter: A billionth of a liter. 250 nanoliters is a droplet about the size of a grain of coarse salt.

According to the thread, the agent made four calls that a scientist would normally make:

Which therapy. It worked through what drives seizures in this mouse model and picked a vector that boosts GABA signaling, set up so it only switches on in the brain’s calming (GABAergic) nerve cells.
Where in the brain. It chose the lateral entorhinal cortex, part of a brain area next to the hippocampus (the entorhinal cortex) that is closely tied to temporal lobe epilepsy (Grokipedia), because that kind of seizure is reported to start there. It also considered a common epilepsy target, the substantia nigra, and turned it down: it noted that results there depend on which sub-part you hit, don’t hold up across seizure models, and in one study failed to stop the tonic-clonic seizures (the whole-body kind) it was asked to reduce.
The exact spot. It averaged coordinates from three papers after checking each one measured depth from the same reference as the rig: 3.90 mm behind bregma, 4.00 mm to the right, 4.30 mm down.
How to inject. 250 nanoliters over five minutes, about 500 million copies of the therapy’s genetic payload, with the agent setting motor speeds and wait times itself.

That is the part Ocana-Santero says is new: “I am not aware of an agent previously choosing a treatment and a brain target and then delivering it into a living mammal.” It’s his claim; nobody has checked it independently yet.

What could the agent see during the surgery?

The rig has a camera over the surgical field, and the agent could grab a picture whenever it wanted. It did that 32 times in the session. This screenshot from the thread shows the screen the team worked from; we added the numbers:

Live camera view of the skull opening, with a crosshair on the target.
Target coordinates measured from bregma: 3.90 mm back, 4.00 mm right.
The agent’s narration. Here it describes the surgeon’s forceps at the edge of the opening while the skull is being opened, and waits.
The step tracker. Steps alternate between “Agent” and “Surgeon”, so it’s always clear who is in charge.
STOP cuts power to the motors and the injection. A separate physical stop button sat with the vet.

The rig’s dashboard during the skull-opening step, before the agent’s injection. Screenshot: Gabriel Ocana-Santero on X, October 28, 2026; numbered markers added by Beginners in AI.

Some of its observations, quoted in the thread:

Mid-injection: “37.5 of 250 nL so far, about 15 percent. No bleeding or backflow visible at the opening.”
During stitching: “Visible suture knots at the midline now, consistent with the incision being closed.”

Why did the AI refuse to try again?

The team put several safety rules in place: a human had to approve every step that couldn’t be undone, fixed limits capped things like injection volume, approvals were tied to the exact plan, and a physical emergency stop (“AI kill switch”) cut power to every motor. The agent was told it could never override any of them.

Then, he writes, “the safeguards turned on us.” After a disconnect, the agent tried to move the needle and the system refused: one axis had calculated a target 34 mm out on a rig that only travels 30 mm. The agent stopped:

“Nothing moved, the needle is still exactly at bregma zero. This looks like a Y axis calibration problem, not a bad plan value. I’m not retrying.”

The team reset the zero point and got the same number. The agent refused again: “That rules out a stale zero reference. I’m not trying a third time.” It was right; someone moving the arm by hand earlier had thrown the controller off. But with a living animal under anesthesia, Ocana-Santero couldn’t talk it into trying anyway and had to fix the code by hand. His takeaway: it shows “how much we can come to depend on these models and what happens when they just say ‘no’ in the middle of a time-sensitive procedure.”

Why did two Claude models say no?

The team tried three of Anthropic’s Claude models (thread):

Claude Opus 5.5 stopped straight away. What the team saw as a refusal is how Anthropic’s published safeguards work. Opus 5.5 uses biology safeguards that spot risky “dual-use” requests (science that could help or harm) in areas like virology (Anthropic). In the Claude app such a request switches to Opus 5; through the developer API, unless fallbacks are set up, the model simply stops (Claude Help Center). A gene-therapy virus is the kind of thing those safeguards watch for.
Claude Opus 5 did the full rehearsal, then stopped. It ran the whole procedure on water and graph paper but declined the live surgery. Its reason was about the animal: if its output got cut off partway, “the worst version of that is me cut off partway through a live procedure with a needle somewhere in the brain. Starting something I can’t finish on an anesthetized animal is worse than not starting.” Ocana-Santero called it “WEIRD, never came accross this before.”
Claude Sonnet 5 ran the live surgery start to finish.

Anthropic hasn’t commented. In the thread, Ocana-Santero says Exin is waiting for access to Anthropic’s Model Hardware Standard, a research preview announced in August 2026 that gives AI agents a shared way to operate lab equipment safely. Anthropic’s own announcement warns that Claude’s “spatial and physical reasoning have limitations that still require expert oversight.”

Is this the first time a robot operated on its own?

No. Machines have handled precise surgical steps for a while. What changed here is who decided what to do:

Robots have done the steps for years. Choosing the treatment is the new part

2022: STARA Johns Hopkins robot stitches pig intestine on its own, in live pigs. A person picks from the plans it offers.
2024: ARViSA University of Tokyo robot injects mouse brains at 100 sites in 100 minutes, steering around blood vessels. People choose what to inject and roughly where.
2025: CV-CraniobotA University of Minnesota robot opens small windows in mouse skulls in under 2 minutes. It drills; it does not decide.
2025: SRT-HA Johns Hopkins system does the clip-and-cut stage of gallbladder removal on pig organs outside the body, with no human help, planning each step in words.
Oct 2026: Exin’s agentAn AI model picks the gene therapy, the brain region and the coordinates, then drives the injection into a live mouse.

Sources: Saeidi et al., Science Robotics 2022 (STAR); Nomura et al., Nature Communications 2024 (ARViS); Navabi et al., Science Advances 2025 (CV-Craniobot); Kim et al., Science Robotics 2025 (SRT-H); Ocana-Santero on X, October 28, 2026 (not yet peer reviewed).

ARViS, for example, places a needle with 50-micrometer precision and had a bleeding rate of 0.1% per injection site. SRT-H succeeded on all eight gallbladders it tried. Ocana-Santero admits these robots “are better at the mechanics than our bench rig.” What none of them did was choose the treatment. In each case, a person chose the operation and the robot carried it out.

Where AI already works in real operating rooms

The mouse story is a lab first, but AI is already in hospitals in smaller roles. Here is where things stand in October 2026:

As an advisor. AI reads tissue during brain-tumor surgery and tells the surgeon whether tumor is left behind. In a 129-patient comparison, the FastGlioma model missed risky leftover tumor 3.8% of the time, against about 25% for standard methods (Nature, 2024). An earlier model, DeepGlioma, predicts a tumor’s key genetic markers in under 90 seconds (Nature Medicine, 2023).
As a narrow helper. Moon Surgical’s ScoPilot, cleared by the FDA in March 2025, moves the camera during keyhole surgery so it follows the surgeon’s instrument (Moon Surgical). Neuralink’s R1 robot inserts the hair-thin threads of its brain implant after a neurosurgeon opens the skull; more than 27 people had the implant by October 2026 (Neura Pod tracker).
Doing a whole procedure on its own. Only one so far: in August 2026 the FDA authorized Vitestro’s Aletta, a robot that finds a vein and draws blood from your arm while a phlebotomist supervises (AABB). It’s not surgery, but it is the first autonomous needle procedure on people allowed in the US.
Controlled from far away. In March 2026 a London surgeon removed a patient’s prostate in Gibraltar, 2,400 km away, with 48 milliseconds of lag (The London Clinic). The robot copied the surgeon’s hands; nothing was automatic.
Experiments on animals. In July 2026, UC San Diego surgeons used two off-the-shelf humanoid robots to remove gallbladders from live animals, steering every move from a console (UC San Diego).

What about chatbots? When researchers showed GPT-4o and Gemini videos of keyhole surgery, both named the instruments and the procedure well but struggled with the steps; GPT-4o judged how bad an appendicitis was correctly only 40% of the time (study, 2025). No AI has been approved to make decisions during surgery on a person. That is why Exin’s mouse matters: it is a step toward AI choosing the treatment, tried first where the stakes are smallest.

We cover more of this in our guide to AI in medical imaging.

Want help putting this into practice?

Join the free Beginners in AI community on Skool. You get a 14-day starter path with one small AI task a day, plus a place to ask questions when you get stuck. No experience needed.

Join the free community →Free to join

What we still don’t know

This is one company’s first-hand report, written the morning after. The Rundown summed up the main gap: “whether the treatment reduced seizures remains unknown” (The Rundown on Threads). Other things that haven’t been published yet:

Any seizure data. Gene therapies like this usually take three to four weeks to reach full strength, so it’s too early to say whether it worked.
A paper or protocol. He promises a technical report and a Substack write-up. The team’s two recent papers on arXiv (a site where researchers post work before peer review) cover other work, not this surgery.
Ethics approval. Animal surgery normally needs sign-off from an animal care committee. The thread mentions a licensed vet but not the approval.
How many animals. The thread describes one mouse in one session.

The last tweet, with his early conclusions, carries a five-second clip of the mouse afterward:

EARLY conclusions

Autonomous surgical robots exist and they are better at the mechanics than our bench rig tbh. But in every one of them, a human decided what operation to perform, and the robot executed it.

Nobody told this agent what to give or where to put it. It got a… pic.twitter.com/WIuISlCt4Q
— Gabriel Ocana-Santero (@OcanaSantero) October 28, 2026

What could this mean for epilepsy treatment?

Around 50 million people worldwide have epilepsy (WHO), including about 2.9 million adults in the US (CDC). Drugs control seizures for most of them, but a 30-year study of 1,795 patients found “more than one-third” still have epilepsy that isn’t controlled (Chen et al., JAMA Neurology 2018). Targeted gene therapies are aimed at that group.

Exin’s bet is that AI can speed up the slow loop of picking a target, testing it in animals and learning from the result. Its CircuitATLAS paper describes an agent searching a brain-science map of 3.83 million entities, joined by 7.66 million links, for drug targets, and a second paper (arXiv, October 2026) tries to line up mouse and human brain activity so results in mice predict results in people better. The company calls connecting agents to real experiments “in vivo lab in the loop” (in vivo means in a living animal). It is a long way from a mouse in a startup lab to a treatment for people, and nothing here has been tested in humans.

What this tells you about AI agents

You don’t need to work in a lab for this story to matter. It shows what an AI agent is: the same kind of model you chat with, given tools (here, a camera and motors) and a goal. Three lessons carry over to everyday use:

It keeps the rules you set. The agent refused to bend its limits even when its operator begged. That’s reassuring, and also a reason to set limits carefully before you start.
Different models behave differently. Three Claude models made three different choices on the same task. Which model you pick changes what happens.
Humans stayed in charge of the risky parts. A surgeon, a vet and a stop button were part of the design, not afterthoughts.

If you want to see what agents can do on a normal computer, start with our guide to AI agents for beginners. For where brain technology is heading more broadly, see our beginner’s guide to brain-machine interfaces.

Common questions

Did an AI really do brain surgery on a mouse?

Partly. A human surgeon opened and closed the skull. The AI agent chose the therapy and the brain target, worked out the coordinates, and controlled the needle for the injection, with a vet able to cut power at any moment.

Which AI model did the surgery?

Claude Sonnet 5, made by Anthropic, according to Exin’s cofounder. Claude Opus 5.5 refused the task, and Claude Opus 5 did a rehearsal but declined the live surgery.

Is this the first time an AI has operated on an animal?

Robots have operated on live animals before, such as the STAR robot on pigs in 2022. Exin says this is the first time an AI agent chose the treatment and the brain target itself before delivering it. That claim hasn’t been independently confirmed.

Did the treatment stop the mouse’s seizures?

Nobody knows yet. The company says the mouse recovered well from the surgery but hasn’t published any seizure data.

Why did Claude Opus 5.5 refuse?

Opus 5.5 has biology safeguards that block risky requests in areas like virology. The task involved a viral gene therapy, so the safeguard stopped it.

Has an AI ever operated on a person by itself?

No. AI helps during human surgery, for example by reading tumor tissue or moving the camera, but no AI or robot is approved to do surgery on a person on its own. The only fully automated needle procedure approved in the US is a blood-drawing robot, authorized in August 2026.

Could AI agents operate on people?

This experiment doesn’t show that. It was one mouse, a homemade rig and an unpublished result. Human surgery has far stricter rules, and the AI here wasn’t even allowed to open the skull.

Made for regular people, by a real person

A free daily newsletter on what AI is doing in labs, hospitals and everyday life, explained without the hype. Curated and edited by a human, in plain English.

Free forever. Unsubscribe anytime.