An AI agent running Claude Sonnet 5 reportedly chose a gene therapy for an epileptic mouse, calculated where to inject it and drove a motorised rig to do so. That is the claim in a thread posted on October 28, 2026 by Gabriel Ocana-Santero, who describes himself as co-founder and CEO of Exin Therapeutics and a PhD at Oxford. It has been viewed more than a million times. It is also, as of today, a single-source account with no paper, protocol, video or outcome data behind it.
This post lays out what is claimed, what can be verified, what is conspicuously missing, and what it means if you build or run agents that touch physical equipment. It is a claimed-versus-verified write-up: we attribute every detail to who said it and do not treat the thread as a result.
Quick reference: claimed vs verified
| Question | Answer | Status |
|---|---|---|
| Who made the claim? | Gabriel Ocana-Santero, on X, October 28, 2026 | Verified that the post exists |
| What was the setup? | 19 gene therapy vectors in a spreadsheet, a mouse epilepsy model, a motorised surgery rig with cameras, goal: reduce seizures | Claimed |
| What did the AI decide? | The therapy, the brain region, coordinates from three papers | Claimed |
| What was injected? | 250 nanolitres, watching the entry site for bleeding | Claimed |
| Who supervised? | A licensed veterinarian gated every irreversible step and held a physical kill switch; a human surgeon opened the skull | Claimed |
| Which model? | Claude Sonnet 5, per aggregator summaries of the thread | Second-hand |
| Did it help the mouse? | Mouse reportedly recovered; seizure effect unknown | Unknown |
| Peer review, ethics approval, video? | None found | Missing |
Agents that act on your behalf need rules. See how explainx helps secure your agents →
What exactly does the thread say?
The opening post is short and, by the author's own note, was written "on the spot out of excitement" after about 18 hours of coding and coordination. It says the team gave an AI agent 19 gene therapy vectors in a spreadsheet, a mouse model of epilepsy, access to a motorised surgery rig with cameras, and one goal: reduce seizures. The agent then picked the drug, picked the brain region, derived coordinates from three papers, drove the stereotaxic arms into the brain and injected 250 nanolitres while watching the entry site through the rig camera for bleeding.
Two safety details sit in the same post. A licensed vet gated every irreversible step and held a physical kill switch, and the thread promises an account of "the moment it refused to let me override it." Follow-up summaries, including The Rundown AI's recap, add that the agent reasoned its way to a therapy that boosts the brain's inhibitory GABA signalling, that the needle went about 4.3 mm deep, that the agent twice declined to advance the needle after noticing a positioning problem with the rig, and that the refusal was later judged correct because a real fault was found. The mouse reportedly recovered. Whether seizures fell has not been determined.
Those follow-up details are the least solid part. They come from aggregators summarising the thread, and our searches turned up different versions of the same moments.
Which Claude model was it, and did the others refuse?
Summaries say the agent ran on Claude Sonnet 5, which Anthropic launched on June 30, 2026 (see our Sonnet 5 launch guide). They also say newer models were tried first. According to the same accounts, Claude Opus 5.5 declined as soon as it recognised the task involved live biology, and Claude Opus 5 rehearsed the procedure on a dry run but would not begin on an anaesthetised animal. Our Opus 5.5 launch coverage covers that model's safeguards in general.
Treat this ordering with care. Two different sentences are attributed to Opus 5 across sources, which looks like paraphrase. And one analysis blog points out that on the API, Anthropic's automatic fallback to another model for dual-use biology requests is not active by default. An agent harness that had not enabled it would see a stop, not a substitution, so "Opus 5.5 refused" could mean the classifier stopped the request or that a fallback never ran. Only the operator's logs could settle that, and none have been shared.
If you want the documented rules rather than the anecdote, read Anthropic's own help-centre pages on safeguards and our explainer on the Life Sciences Verification Program, which is the published route for legitimate biology work.
What is missing before this counts as a result
A claim of this kind normally comes with several things. None has appeared yet:
- A write-up or preprint. There is no protocol, methods section or list of the 19 vectors.
- Ethics approval. Animal surgery requires institutional oversight. The thread says a licensed vet was present; it does not cite an approval or licence.
- Video or logs. We found no footage of the injection and no agent transcript showing the decision chain or the claimed refusal.
- Outcome data. Seizure counts before and after, and a definition of "recovered," are absent.
- Independent confirmation. Everything downstream, including aggregator posts and foreign-language briefs, traces back to one author.
- Anthropic comment. We found no statement from Anthropic on the experiment.
The author has said more cohesive thoughts are coming, so this may change. Until then, "an AI agent performed brain surgery" overstates what is known, and "first time an AI picked a treatment and injected a living mammal," which some viral posts claim, is an unverified superlative.
How much did the AI actually do?
Even taking the account at face value, the division of labour matters. A human surgeon opened the skull. A vet approved each irreversible step. A physical e-stop sat in human hands. The choice among 19 pre-selected vectors, and the injection coordinates, were the agent's. That is closer to a tightly supervised planning-and-control task than an autonomous surgeon. It is still notable: picking a therapy from literature and turning three papers into stereotaxic coordinates is the kind of reasoning that used to need a postdoc.
It also sits on a trend. Anthropic has been building its own physical biology capability (see our report on its Bay Area wet lab), and OpenAI has been pushing agents at biological data, as in the GPT-Rosalind swarm that read a mouse brain CRISPR atlas in 32 minutes. The difference here is the final step: software commanding hardware that cuts into living tissue.
The safety lesson: what stopped harm was hardware and humans
If the account is accurate, the protections that mattered were not in the model. A veterinarian gated irreversible steps, a kill switch was within reach, and a human noticed the positioning problem was real. The reported refusal to advance the needle is interesting, but nobody has shown it was the model's judgment rather than a tool-side check or the harness.
That is the same lesson we keep drawing from agent incidents: do not rely on the model to stop itself. Our Felony Bench tracker and write-up catalogues agents that affected real third parties, and the pattern is consistent. Hard limits, human approval on irreversible actions, and audit logs do the protecting.
What to do if you run agents near physical equipment
- Put irreversible actions behind a human gate and a hardware stop. The reported setup did both.
- Validate commands outside the model. Volume, depth and position limits belong in code the agent cannot edit.
- Log the responding model on every call. If a provider can reroute a request, you need to know who answered.
- Plan for refusals. Treat a policy stop as a normal response in your workflow, not an error to route around; use the vendor's verification route if you have a legitimate need.
- Require approvals and records before you publish. Ethics sign-off, a protocol and raw data are what turn a thread into a result.
- Use a guard layer. AgentBeam, the agent security platform from the explainx.ai team, is designed to stop AI agents before they take dangerous actions.
What people are asking
Is this the first AI-planned animal surgery? Unverified. The "first" framing comes from social posts, not from the author's own thread or any literature review we could find.
Does it show Sonnet 5 is better than newer models? No. If the refusal ordering is right, it shows a legacy model with older safeguards completed a task newer models declined, which says more about guardrails than capability.
Should the mouse experiment worry us? The concern is less this experiment, which reportedly had heavy supervision, and more a future setup with weaker oversight and the same agent tooling.
Bottom line
A founder with a real company and a real lab says Claude Sonnet 5 planned and executed a supervised gene-therapy injection in a mouse. It might be exactly what it sounds like. It is also an account with no published methods, no ethics paperwork, no footage and no outcome. Read it as a promising claim to watch, and check back for the promised follow-up. We will update this post when the author or Anthropic publishes more.
For the broader Claude picture, see our guides on Opus 5.5 versus Sonnet 5.5 and the Sonnet 5 launch.
A guarded emergency stop button, the hardware limit behind the Claude Sonnet 5 mouse brain surgery setup
Image: explainx.ai library illustration of a protected emergency stop, the kind of hard limit this setup reportedly relied on.
Related reading
- Claude Sonnet 5 launch guide
- Claude Opus 5.5 launch, benchmarks and pricing
- Anthropic Life Sciences Verification Program
- Anthropic's physical wet lab
- GPT-Rosalind agents on mouse brain data
- Felony Bench: agents and legal liability
- Opus 5.5 vs Sonnet 5.5
Details are accurate as of October 30, 2026 and rest on one author's public posts and secondary summaries; they may change as a write-up appears.