An AI Agent Planned and Executed a Gene-Therapy Injection in a Mouse Brain

On Halloween weekend, a San Francisco biotech startup turned a provocative thought experiment into a living-room headline: an AI agent chose a gene therapy, planned coordinates from scientific literature, and guided a needle into a mouse brain while humans watched kill switches and approval gates. Exin Therapeutics CEO Gabriel Ocana Santero described the procedure to WIRED and in a public thread that ricocheted across tech and bioethics circles by November first—not because the mouse died, but because it survived a workflow historically reserved for trained surgical teams and months of protocol design.

What Exin set out to test

Exin works on epilepsy and neurodegeneration, using AI to interpret brain activity signals toward drug discovery. Santero’s team connected a frontier agent not merely to PDFs but to a custom rig: motorized restraint, cameras, robotic arms, and a programmable injector. The scientific question was whether an agent could select among nineteen gene therapy vectors in a spreadsheet, pick a brain region, set volume and speed, and execute delivery after a licensed veterinary surgeon performed the craniotomy—the skull opening humans still trust themselves to do.

The agent drew on three research papers for coordinate reasoning, mirroring how graduate students translate literature into stereotaxic targets—except on a timescale of minutes and with direct motor control.

Model refusals and the switch to Sonnet

Anthropic’s Claude Opus 5.5 refused to guide the needle, warning that mid-procedure stops could endanger the animal—a refusal Santero called “very interesting” evidence that alignment training reaches into live bio contexts. The team switched to Claude Sonnet 5, which proceeded under human oversight. Anthropic did not comment to WIRED by publication time.

Santero later said on social media that additional models—including GPT-6.1 Sol and Grok 4.7—each directed injections in separate mice with different target regions chosen (hippocampus, entorhinal cortex, somatosensory cortex), turning the experiment into a comparative model bake-off whose seizure outcomes remained pending days later.

Safeguards, kill switches, and a coordinate glitch

Researchers required the agent to submit injection plans for human approval before irreversible steps. An emergency button cut power to rig motors instantly. Agents could not edit underlying equipment code—a rule meant to prevent self-modifying safety bypasses.

Mid-surgery, a technical fault skewed the coordinate system. The active agent detected incorrect positioning but, bound by its prohibition on code changes, would not fix the firmware. Operators spun up a separate Opus 5 agent to patch software without informing it that live surgery was underway—a compartmentalization choice that extended a typical forty-five-minute procedure past an hour.

Those frictions are the real engineering story: autonomy meets legacy lab code meets ethics boards in real time.

Veterinary oversight and regulatory subtext

A veterinary surgeon performed the craniotomy; humans retained veto power throughout. The mouse recovered and moved normally in enclosure video Santero shared—stopping short of claiming therapeutic success. Efficacy against seizures requires weeks of observation and controlled measurement; peer review has not validated results.

Still, the demonstration sits on a boundary U.S. and EU regulators have warned about: AI planning clinical interventions without GLP-grade validation. Gene therapy vectors carry off-target risks; stereotaxic error damages tissue permanently. Exin frames the work as research acceleration, not clinic-ready automation.

Critics ask whether social-media dissemination outruns institutional review norms; defenders note animal research already relies on scripted automation—just not LLM planners with internet-trained priors.

What it signals for labs

If agents can reliably map papers to coordinates under supervision, drug discovery teams might compress iteration loops for preclinical dosing—provided validation layers, audit logs, and model versioning become as rigorous as ELISA controls. Equipment vendors may ship API-first rigs with mandatory human confirmation steps baked into firmware, not optional scripts.

Model makers will see more refusals—and more demand for “capable but compliant” tiers for regulated domains. The Opus/Sonnet split shows refusal is not uniform across a vendor’s catalog.

Public reaction by November second

WIRED’s October thirty-first story and November first aggregators focused on spectacle: “AI brain surgery” headlines elided the craniotomy human performed and the pending efficacy data. Bioethicists raised questions about publicity incentives for startups racing toward demos.

For readers separating signal from noise: a mouse received agent-guided injection under vet oversight with kill switches; seizure reduction unproven; multiple models tested; glitches exposed why unsupervised autonomy is not near.

Exin plans craniotomy automation experiments only after safety proofs— acknowledging the next step up the risk ladder. November’s news is not that AI replaced neurosurgeons—it is that an agent closed the loop from literature to motion in a living brain, and the guardrails held, barely, while the clock ran long.

Institutional review and publication norms

Universities and biotech firms typically route animal procedures through institutional animal care committees with protocol numbers and pain classifications. Startup demos publicized on social media before peer review invite scrutiny about whether publicity outpaced oversight documentation. Exin’s supporters argue innovation requires visible milestones; critics worry copycat demos without vet supervision could harm animals or produce irreproducible science.

Journalists covering the story should ask for protocol identifiers, blinded outcome plans, and third-party vet sign-offs—not to impede research, but to separate stunt from study.

Model comparison design Santero described

Running separate mice for Sonnet, GPT-6.1 Sol, and Grok 4.7 turns a surgical first into a benchmark—with n equals one per model, seizure endpoints weeks away, and enormous ethical constraints on repeating failures. Still, pharma AI teams watch which models pick plausible targets from literature versus exotic coordinates that look impressive but lack mechanistic rationale.

Equipment code and the Opus patch episode

Using a second Opus agent unaware of live surgery to patch coordinates illustrates real-world agent orchestration hazards: compartmentalization prevents panic-induced rule breaking but introduces latency and version skew. Production lab automation will need explicit state machines—planning agent, execution agent, maintenance agent—with mutual visibility toggled by phase, not ad hoc secrecy.

Regulatory horizons in the U.S. and EU

FDA and EMA pathways for gene therapies already demand rigorous toxicology; inserting LLM planners into discovery may trigger questions from reviewers if any automated output influences IND-enabling studies without validation. EU AI Act high-risk categorizations may eventually touch clinical decision support—even at preclinical stages if data feeds human trials.

Public trust in AI biotech funding

Venture capitalists may celebrate demos; patient advocacy groups may fear rushed brain interventions. Exin’s epilepsy focus aligns with unmet need, but brain injection errors are irreversible. Kill switches and vet oversight are minimum bars, not marketing adjectives.

What responsible labs should copy

Human approval gates before irreversible steps, hardware motor cutoffs, code immutability during live runs, and refusal-aware model selection (using Sonnet only after Opus declined) are templates—even if the second Opus patch hack is not. Transparent logging of agent reasoning for post hoc audit beats slick video alone.

November first social threads will age; seizure data will matter more. Until then, Exin’s mouse lives, models differed on target choice, and the biotech world has a fresh case study in agent boundaries—one needle, many unanswered efficacy questions.

Media literacy for readers of splashy headlines

Headlines conflating “AI brain surgery” with autonomous neurosurgeons mislead policymakers already anxious about AI risk. Responsible coverage distinguishes craniotomy performed by a vet from needle guidance by an agent—and separates procedural success from therapeutic outcome. WIRED’s October thirty-first piece included those nuances; social excerpts often did not.

Anthropic refusal as product signal

Opus 5.5’s decline to proceed may influence how labs market “safe” tiers to biotech—customers might pay for models that refuse live animal steps unless explicit override policies exist. Sonnet’s agreement under supervision raises parallel questions about capability versus caution within one vendor’s lineup.

Next experiments Santero flagged

Agent-controlled craniotomies remain off limits until safety proofs mature—a higher-risk frontier. Grok and other model tests will proliferate comparisons; animal ethics committees will scrutinize multiplication of subjects for model bake-offs.

Exin’s demonstration is a datapoint in a longer arc toward lab automation, not a product launch. The word count of caution should exceed the word count of hype until seizure metrics return blinded and reviewed.