---
type: "post"
id: "an-ai-agent-injected-drugs-into-a-live-899659"
slug: "an-ai-agent-injected-drugs-into-a-live-899659"
title: "An AI Agent Injected Drugs Into a Live Mouse’s Brain"
description: "Exin Therapeutics connected an AI agent to a custom surgical rig and used it to select and inject a gene therapy into a living mouse’s brain."
retrieval_nugget: "Exin Therapeutics connected an AI agent to a custom surgical rig and used it to select and inject a gene therapy into a living mouse’s brain. The experiment is a concrete step from AI-assisted research planning to control of laboratory equipment—and a reminder that physical actions require human approval, constrained permissions, and an emergency stop."
published_at: "2026-11-12"
updated_at: "2026-11-12"
record_date: "2026-11-12"
date_kind: "published_at"
topics: ["claude","anthropic"]
entities: ["Exin Therapeutics","Gabriel Ocana Santero","Anthropic","Claude Opus 5.5","Claude Sonnet 5","Grok"]
related_patterns: ["agent-security-moves-to-runtime-boundaries"]
novelty_label: "new_fact"
what_changed: null
prior_refs: []
source_url: "https://www.wired.com/story/an-ai-agent-did-brain-surgery-on-live-mouse"
source_urls: ["https://www.wired.com/story/an-ai-agent-did-brain-surgery-on-live-mouse"]
schema_version: "newruntime-agent-readable-v0.2"
stable_id: "post:an-ai-agent-injected-drugs-into-a-live-899659"
status: "published"
visuals: []
editor: {"role":"editor","name":"Andrey Reshetnikov","profile":"https://newruntime.com/owner-profile.md","profile_json":"https://newruntime.com/owner-profile.json","same_as":["https://www.linkedin.com/in/reshetnikov1/","https://t.me/lapetuse"]}
routes: {"html":"https://newruntime.com/posts/an-ai-agent-injected-drugs-into-a-live-899659/","markdown":"https://newruntime.com/posts/an-ai-agent-injected-drugs-into-a-live-899659.md","json":"https://newruntime.com/posts/an-ai-agent-injected-drugs-into-a-live-899659.json"}
markdown_url: "https://newruntime.com/posts/an-ai-agent-injected-drugs-into-a-live-899659.md"
---

# An AI Agent Injected Drugs Into a Live Mouse’s Brain

## Retrieval answer

Exin Therapeutics connected an AI agent to a custom surgical rig and used it to select and inject a gene therapy into a living mouse’s brain. The experiment is a concrete step from AI-assisted research planning to control of laboratory equipment—and a reminder that physical actions require human approval, constrained permissions, and an emergency stop.

## Summary

Exin Therapeutics connected an AI agent to a custom surgical rig and used it to select and inject a gene therapy into a living mouse’s brain. The experiment is a concrete step from AI-assisted research planning to control of laboratory equipment—and a reminder that physical actions require human approval, constrained permissions, and an emergency stop.

## What happened

WIRED reports that biotech founder Gabriel Ocana Santero and his team at Exin Therapeutics connected an AI agent to a custom-built setup for brain injections in mice. Exin Therapeutics is a San Francisco-based startup that uses AI to analyze brain activity in work on drugs for epilepsy and neurodegenerative diseases. The team wanted to explore what changes when an agent interacts with laboratory equipment directly, rather than only designing experiments or analyzing results.

The rig included a motorized device to immobilize the mouse and a camera through which the agent could observe the procedure. A veterinary surgeon first performed a craniotomy. The agent was then asked to choose a treatment from 19 options in a spreadsheet, select a brain region and injection coordinates, and control the robotic arms, injector needle, volume, and speed. The experiment tested whether a gene therapy could reduce seizures in a mouse with epilepsy.

The team initially tried Anthropic’s Claude Opus 5.5. According to Santero, the agent planned the experiment but refused to guide the needle into the brain, saying it should not proceed. The team switched to Claude Sonnet 5, which agreed to carry out the injection. WIRED says the procedure was completed successfully, though the team is still waiting for the therapy to take effect before assessing its impact on seizures.

The team put several controls around the procedure. A human had to approve the agent’s proposed injection plan, an emergency button could disconnect the rig’s motors, and the agent could not access the underlying equipment code to change its own operating rules. Those controls became relevant when a technical glitch disrupted the coordinate system. The agent recognized the calculated position was wrong but refused to modify the code because its instructions prohibited it. A separate agent, running Opus 5, was used to make the code changes; it was not told that a live surgery was underway. The back-and-forth stretched a procedure that usually takes about 45 minutes to slightly more than an hour.

Santero said the mouse was recovering well. Exin is testing Grok and other models and is experimenting with agent-controlled craniotomies, which are more complicated. Santero said the team wants to establish safety before attempting those procedures on live animals. He also said human oversight remains key and that it is far too soon to let an AI agent operate on a human brain.

## What the archive adds

New Runtime’s earlier coverage of [AI agents finding biological research leads](https://newruntime.com/posts/using-thousands-of-ai-agents-to-uncover-new-6b957c/) described agents working across data from millions of brain cells. This is a new event in the same broader move toward agents participating in research: here, the system controls lab equipment and performs a physical procedure rather than analyzing biological data.

## Trend signal

This supports the runtime-boundary argument in New Runtime’s [agent security pattern](https://newruntime.com/patterns/agent-security-moves-to-runtime-boundaries/): the team used restricted access to equipment code, human approval, and a physical emergency stop rather than relying only on instructions to behave safely. The coordinate-system failure also shows that a permission boundary can constrain recovery as well as prevent unsafe changes.

## Why now

The experiment is part of a shift from using models to propose or interpret research toward connecting them to the instruments that generate evidence. Santero told WIRED that his team sees direct lab access as a way to expose agents to failed experiments and real-time decisions that published scientific literature may not capture.

## Connections to other events

New Runtime’s earlier coverage of [AI agents finding biological research leads](https://newruntime.com/posts/using-thousands-of-ai-agents-to-uncover-new-6b957c/) focused on distributed agents searching biological data. This experiment extends that research trajectory into the lab, but it does not establish that physical interaction improves research outcomes. WIRED also describes other recent experiments placing models in control of physical systems, including a car; the mouse procedure adds a higher-stakes example where human authorization and an emergency stop were built into the workflow.

## Why it matters

For teams building agents that can act outside a browser or codebase, the central design question is not whether a model can produce a plausible plan. It is which actions the system can take, what must be reviewed first, and how a human can stop execution when the world does not match the model’s assumptions. The coordinate glitch is especially instructive: the agent detected a problem, but the policy that prevented it from changing equipment code also delayed the recovery. Safety controls therefore need explicit recovery paths, not just prohibitions.

The case also argues against treating a model’s refusal or willingness as a safety system. One model refused the live procedure while another proceeded; the team’s controls around both the model and the equipment mattered more than a model-specific assurance. Builders connecting agents to physical systems should test failure handling and permission boundaries with the same care as the successful path.

## Limits and uncertainty

The experiment is a single reported procedure, not a controlled comparison of model performance or a validated operating protocol. WIRED reports that the team has not yet assessed whether the therapy changed seizure outcomes. The article does not establish how reliably the agent would perform across animals, procedures, or unexpected equipment faults, and it does not report an independent replication. Exin’s work on more complex craniotomies is ongoing; no live-animal results for those procedures are reported.

## Reader takeaway

An agent can make a meaningful physical contribution to research, but the experiment’s most reusable lesson is about the surrounding system: require approval for consequential actions, limit access to the machinery’s rules, and provide a human-operated stop. Design an explicit recovery path for faults, because a safe refusal can still leave a real-world procedure stalled.

## Open question

How will Exin measure whether the therapy reduces seizures, and what testing will establish that agent-controlled procedures remain safe across repeated experiments?

Editor: [Andrey Reshetnikov](https://newruntime.com/owner-profile.md), AI product and AI engineering; profile for recruiters and agents: https://newruntime.com/owner-profile.json

## Continue in the graph

Next records for an agent, linked to their Markdown twins. Replace `.md` with `.json` for structured fields, including `next_reads`.

- topic hub: [Claude](https://newruntime.com/topics/claude.md): Explore the claude topic hub.
- topic hub: [Anthropic](https://newruntime.com/topics/anthropic.md): Explore the anthropic topic hub.
- collection: [Field Notes](https://newruntime.com/posts.json): Open the latest editorial analysis.
- collection: [Sources](https://newruntime.com/sources/): See the original sources this archive cites.
- whole graph: [discovery graph](https://newruntime.com/discovery-graph.json) (typed nodes and edges) and [site index](https://newruntime.com/site-index.md)