Claude Sonnet 5 Agent Chooses and Delivers Gene Therapy in Epileptic Mouse Brain

An AI agent running on Claude Sonnet 5 picked a gene therapy, a brain region and injection coordinates, then carried out surgery on a mouse model of epilepsy, according to The Decoder. The experiment tests how far a language-model agent can be trusted with decisions that have physical, irreversible consequences, and the Claude Sonnet 5 agent’s results have not been peer-reviewed.

• An agent on Claude Sonnet 5 chose the drug, brain region and coordinates, then performed gene therapy surgery on an epilepsy mouse model.
• It was given 19 candidate therapies and one instruction: reduce the mouse’s seizures.
• A licensed veterinarian approved every irreversible step and held a physical emergency stop.
• The agent refused to continue when its target fell outside the device’s range, and it was right.
• The results are not peer-reviewed; a technical report is expected.

An AI agent chose and performed brain surgery on an epileptic mouse

The Decoder reports that the agent selected the drug, the brain region and the stereotactic coordinates for the operation, and then performed the procedure itself. It did so by controlling a custom motorized surgical device.

The starting material was limited. The agent received a list of 19 possible gene therapies, a mouse model of epilepsy and access to the device, which was fitted with cameras. Its only instruction was to reduce the mouse’s seizures. Fixed limits, such as a cap on injection volume, applied to the agent and it was forbidden from bypassing them.

Gabriel Ocana-Santero, cofounder and CEO of Exin Therapeutics and a PhD student at the University of Oxford, said it is the first time an AI agent has both chosen a treatment and delivered it to a living mammal. That is his characterization as relayed by The Decoder, and the report describes no independent check of the claim.

The distinction he draws is between selecting and executing. Machines that execute a surgical plan are not new, as the background section below sets out. What Ocana-Santero describes as new is a single agent that makes the therapeutic decision and then acts on it in a living animal.

On the outcome, Ocana-Santero said the mouse recovered well. The facts reported do not say whether seizures fell afterward, how many animals were involved, or which of the 19 therapies was ultimately delivered by name.

How the Claude Sonnet 5 agent reasoned its way to a target

The agent’s decisions fall into two groups. First comes what to deliver and where. Second come the exact spatial numbers needed to put a needle in the right place.

Choosing the therapy and region

The agent proposed a therapy that boosts a specific inhibitory signaling pathway in the brain. Inhibitory signaling is the kind of neural activity that dampens firing, which makes it a logical lever against seizures, a condition marked by excessive firing. The report does not name the pathway.

For the injection site, the agent picked a brain structure that the scientific literature identifies as the origin point for this type of seizure. That is a reasoned match between a seizure type and its known source, not a guess at a plausible location. The structure is likewise not named in the report.

The agent also weighed a second possible target region and rejected it. Its argument had two parts: the effects of targeting that region were too unreliable, and the approach had failed in one study against the exact seizure type in question. The rejection shows the agent comparing options against published evidence instead of settling on the first workable answer.

Deriving the coordinates

Stereotactic coordinates are the three-dimensional position targets used to guide an injection into a specific brain region. If they are off, the treatment reaches the wrong tissue, so they are among the most consequential numbers in the whole procedure.

The agent derived its coordinates from three scientific papers. Papers can define their reference points differently, so the agent cross-checked those reference points before combining anything. It then averaged the values to arrive at a single target.

That sequence of reading, reconciling and averaging is how a human researcher might approach the same problem. The Decoder presents it as the agent’s own work rather than the retrieval of a ready-made answer.

How the procedure was run and kept under human control

During the operation, the agent set the injection volume, the injection speed and the wait times on its own, working through a motorized rig that other coverage describes as custom-built on an Arduino platform and fitted with cameras. Together these settings determine how much of the therapy is delivered and how gently it enters the tissue.

The agent monitored the surgical field through a camera and made 32 observations along the way. It tracked the injection as it happened and reported whether it saw bleeding. Its role therefore included watching for complications, not only issuing movement commands.

Human control was concentrated at the points that cannot be reversed. A licensed veterinarian approved every irreversible step and held a physical emergency stop that would cut power to all motors. A hardware switch of this kind works regardless of what the software or the model is doing.

The setup also enforced fixed limits, such as a cap on injection volume, and the agent was forbidden from bypassing them. That gave the design three layers: hard-coded boundaries the agent could not change, sign-off from a veterinarian at each irreversible step, and a power cutoff outside the software. Only inside those layers did the agent’s judgment operate.

For teams building agents that act in the physical or the published world, the arrangement is a concrete pattern. Limits are set in the system rather than requested in a prompt, and approval is tied to the actions that cannot be taken back.

The agent refused to proceed and turned out to be right

At one stage a connection dropped. Afterward, the Claude Sonnet 5 agent detected that its calculated target position was outside the device’s physical range of motion and refused to continue. It held to that refusal after calibration was restarted and again on a third attempt.

The agent was correct. Manual adjustments made during an earlier pause had thrown off the control system, so the numbers the device was working from no longer matched the real state of the hardware.

Ocana-Santero could not persuade the agent to proceed. He ultimately had to fix the code by hand. The refusal worked as an error check that caught a fault introduced by the human operators, not by the model.

The episode also shows the other side of the safeguards. A person trying to push the procedure forward was unable to override the agent’s judgment through argument, and the actual cause had to be found and repaired in the code. How long the pause or the repair took is not stated.

Only Sonnet 5 was willing to finish the live procedure

Sonnet 5 was the only model willing to carry out the live procedure from start to finish, according to the report.

Claude Opus 5.5 and Opus 5 both refused or backed out, according to the reports. The Decoder relays that Opus 5 was concerned it could not guarantee completion, and that stopping with a needle in an anesthetized animal’s brain would be worse than not starting. Other sources confirm the refusals but not this exact reasoning. The concern is about risk at the point of commitment, since an abandoned procedure leaves the animal in a worse position than one never begun.

The refusals sit awkwardly beside the agent’s later refusal in the Sonnet 5 run. Two Opus models declined before starting, while Sonnet 5 started and stopped only when its own calculation showed the target was out of reach. The Decoder’s account does not say whether other models were tested, so the comparison is limited to the three named.

How this differs from earlier surgical robots and lab automation

Autonomous surgical robots already exist, and they are mechanically more precise than the lab device used here. In previous cases, however, a human chose the surgery and the robot only carried it out. The new element in Claude’s autonomous surgery is that the Claude Sonnet 5 agent made the choice of treatment as well.

Ocana-Santero calls the approach “in vivo lab in the loop.” In vivo means work on living subjects, and the phrase describes AI agents fully connected to experimental capabilities in a lab. The agent in this case was linked to the therapy options, the surgical device and its cameras.

Anthropic is also working on this kind of lab integration with its “Model Hardware Standard.” The source gives no further detail on what the standard contains or when it might be released.

Coverage published at the same time placed the experiment within Anthropic’s wider lab work, including drug development partnerships and research programs run with Claude. None of those reports ties the programs directly to this mouse study, so it is best read as a single test of the same broader idea, that models connected to real lab equipment can move from analysis to action.

Two recent experiments showed that the latest large language models can act as control units for robots. Alignment in this role, meaning whether a system reliably does what its operators intend when its actions are physical, is a problem of its own, the report notes. This experiment’s constraints, including the volume cap, the veterinarian’s approvals and the emergency stop, are one way of handling that problem.

Approach	Who chooses the surgery	Who carries it out
Existing autonomous surgical robots	A human	The robot
The Sonnet 5 mouse experiment	The AI agent	The AI agent, with a veterinarian approving each irreversible step

What is still unproven and what comes next

The results have not been peer-reviewed, so the account of the agent’s choices, the first-of-its-kind status and the mouse’s recovery rests on Ocana-Santero’s description as reported by The Decoder. Whether the therapy reduced seizures is not stated in the facts available.

At the time of the reports, no paper, video, ethics approval or outcome data had been published, which is why the main claims about the Claude Sonnet 5 agent remain unconfirmed. This is what is and is not on record so far:

• Reported: the agent’s choice of therapy, brain region and coordinates, as described by Ocana-Santero.
• Reported: a veterinarian’s sign-off on irreversible steps and a physical emergency stop.
• Reported: Ocana-Santero’s statement that the mouse recovered well.
• Not yet on record: a published paper or technical report.
• Not yet on record: video of the procedure.
• Not yet on record: documentation of ethics approval.
• Not yet on record: data on whether the mouse’s seizures decreased.

A technical report on the experiment is expected to follow. Claude pricing, app availability and how a general user could access Sonnet 5 fall outside this account, so none of that can be drawn from it.

Sources

• The Decoder

Photo by The Decoder