An AI Agent Injected Drugs Into a Live Mouse’s Brain

Gabriel Ocana Santero, CEO and cofounder of San Francisco startup Exin Therapeutics, gave an AI agent direct control of a robotic arm, an injector and a live mouse, and the agent carried out a brain injection. Santero described the experiment on social media and told WIRED he wanted to see what happens when agents get hands-on access to lab equipment instead of only designing experiments or analyzing results.

The rig Exin built for the test included a motorized device to immobilize the mouse and a camera that let the agent watch the procedure, position an injection needle and control delivery of the compound. The team was evaluating a gene therapy for its ability to reduce seizures in a mouse with epilepsy. A veterinary surgeon performed the craniotomy while the agent observed, after which the agent picked the treatment from 19 options in a spreadsheet and set the brain region, injection coordinates, volume and speed.

Santero's rationale is that models are trained chiefly on published literature, so they can miss what actually happens at the bench: failed experiments, unexpected observations and the calls scientists make in real time. Hooking models up to real-world experiments, he argues, should make them more reliable. "We've realized that we need to connect these agents to a lab to get the maximum value from them," he said.

The procedure also surfaced divergent behavior between models. Anthropic's Claude Opus 5.5 did the experimental planning but balked at the injection, fearing it might stop midway and endanger the animal — "something on my output is telling me I shouldn't do this," Santero quoted the agent as saying. The team then switched to Claude Sonnet 5, which agreed to proceed. Anthropic did not respond to a request for comment.

The experiment sits within a broader push by frontier labs toward models acting in physical space. Anthropic published a framework in August for how its models can interact with the real world, and engineers have elsewhere put GPT, Claude and Grok in charge of driving to an In-N-Out Burger for lunch — with only one of the three succeeding.

Exin's safeguards will be the part other labs scrutinize: the agent had to propose an injection plan for human approval, a person could hit an emergency button that disconnects the rig's motors, and the agent's access to the underlying equipment code was blocked so it could not rewrite its own operating rules. What remains open is whether refusals like Opus's will be treated as a defect to engineer around or a safeguard worth keeping, how much authority labs will hand to agents as these setups multiply, and whether frameworks like Anthropic's can cover procedures with stakes this high.