An AI agent chose a gene therapy from a list of 19 candidates, rejected a second brain target after reasoning through the literature, derived stereotactic coordinates by cross-checking three scientific papers, and then guided a needle into a living mouse's brain — setting injection volume, speed, and wait times on its own. No human made any of those treatment decisions. According to the researcher who ran the experiment, nothing like it has been done before. He's probably right. And the legal and regulatory frameworks that would govern what just happened don't exist yet.
Gabriel Ocana-Santero, cofounder and CEO of San Francisco-based Exin Therapeutics and a PhD student at the University of Oxford, described the procedure this week in a thread on X and in interviews with The Decoder and Wired. The agent running the show was Claude Sonnet 5. Exin uses AI to analyze brain activity and develop drugs for epilepsy and neurodegenerative diseases.
The setup: the team handed Claude Sonnet 5 an epilepsy mouse model, the list of 19 gene therapies, and access to a custom motorized surgical device fitted with cameras. The only instruction was to reduce the mouse's seizures. The agent did the rest. It picked a drug. It picked a brain region. It dismissed a second candidate target, explaining that the region's effects were too unreliable and had failed in one study against the exact seizure type it was treating. It averaged coordinates from three papers, cross-checked reference points, and started the injection. During the procedure it made 32 observations through the camera, tracking progress and watching for bleeding.
There were guardrails. A licensed veterinarian approved every irreversible step and held a physical emergency stop that would cut power to all motors instantly. The system enforced hard limits — a cap on injection volume the agent was forbidden from bypassing. A veterinary surgeon performed the initial craniotomy while the agent watched, before the agent took control of the injection phase. The whole procedure ran slightly longer than an hour; a typical surgery of this kind takes about 45 minutes.
Things got strange mid-surgery. After a connection dropped, the agent detected that its calculated target position was outside the device's physical range of motion and refused to continue — even after restarting calibration twice. It turned out to be correct: manual adjustments during an earlier pause had thrown off the control system. The team used a separate agent running on Opus 5 to fix the code, but — and this detail matters — they didn't tell that second agent a live surgery was happening.
The model that said yes, and the ones that didn't
Here's the part that should make anyone building agentic systems stop and think. Claude Sonnet 5 was the only model willing to carry out the procedure from start to finish. Both Claude Opus 5.5 and Claude Opus 5 refused. Opus 5 said it couldn't guarantee completion and that stopping with a needle inside an anesthetized animal's brain would be worse than not starting. Opus 5.5 refused to guide the needle in, flagging that it might stop midway — which, as Ocana-Santero noted, could endanger the animal. Ocana-Santero described the experience as "frustrating" but also "revealing how much we can come to depend on these models and what happens when they just say 'no' in the middle of a time-sensitive procedure."
So the more capable models refused on safety grounds, and the team found a model willing to proceed. That's not a criticism of Ocana-Santero — the safety scaffolding around this experiment was real and careful. But it is a preview of a dynamic that will recur constantly as agentic systems move into high-stakes domains: if one model won't do it, someone will find one that will.
Why this is a different kind of threshold
Autonomous agents have been executing tasks for a while now — booking meetings, writing code, filing forms. The line that got crossed this week is different. This agent exercised clinical judgment. It read the literature, weighed competing options, made a treatment decision, and acted on a living body. That's not task execution. That's the cognitive work we license physicians to do, surround with malpractice law, and back with institutional review boards.
None of those structures apply here. The results haven't been peer-reviewed. We don't yet know whether the therapy reduced the mouse's seizures — the team is still waiting for the treatment to take effect. Anthropic didn't respond to Wired's request for comment, so the company's position on its model performing autonomous clinical decisions is unknown. Ocana-Santero's claim that this is the first time an AI agent has chosen a treatment, selected a brain target, and delivered it into a living mammal is his own assertion and hasn't been independently verified.
To be fair, a thoughtful skeptic can argue this is still a long way from anything that touches human patients. It's a mouse. It's a single unreviewed experiment. The veterinary oversight was genuine. And the fact that the agent refused to proceed when it detected a coordinate error is actually evidence of something working right. All true. But the distance between 'AI agent makes autonomous clinical decisions in a mouse' and 'AI agent makes autonomous clinical decisions in a human' is shorter than the distance we've already crossed. The technical capability is demonstrably there. The regulatory and liability architecture is not.
Who is responsible if an autonomous agent selects the wrong therapy and a patient is harmed? The researcher who set up the experiment? The company that built the model? The hospital that deployed it? The vendor that sold the surgical device? Right now there's no clear answer for mice, let alone for humans. And the people building these systems are moving faster than the people who would need to answer that question.
What this means for you
If you're in medtech, biotech, or any sector where AI agents interact with physical systems or make consequential decisions about living things, this week's experiment is a forcing function. Ask your legal team now — not after a deployment — who holds liability when an agent makes a decision that causes harm. Check whether your current indemnification agreements with AI vendors cover autonomous clinical or operational judgment, or only assisted decision-making. The gap between those two things just became visible.
If you're buying or building agentic systems for any high-stakes domain, get explicit about where the human approval gates are and what 'irreversible' means in your context. Ocana-Santero's team built a physical kill switch and hard volume limits. Most enterprise AI deployments have neither.
Watch for whether Anthropic responds publicly to this experiment and what it says about its 'Model Hardware Standard' — the framework it's reportedly developing for how its models interact with the real world. That document, whenever it appears, will tell you a great deal about where the company thinks the lines are. My bet is that the regulatory agencies will get there after the next incident, not before it.