Claude Sonnet 5 在无人决策下自主选择基因疗法并完成小鼠脑部手术

An AI agent chose a drug, target region, and coordinates for surgery on a mouse model of epilepsy, then performed the procedure. Midway through, it refused to bypass a safety restriction.

The team gave Claude Sonnet 5 a list of 19 possible gene therapies, an epilepsy mouse model in which researchers induce seizures to test treatments, and access to a custom motorized surgical device with cameras. Its only instruction was to reduce the mouse's seizures.

The agent selected the drug, brain region, and stereotactic coordinates on its own, according to Gabriel Ocana-Santero, Exin Therapeutics cofounder and CEO and a PhD student at the University of Oxford. He described the procedure in a thread on X.

How the agent picked its therapy and target

The agent first analyzed how seizures arise in this particular model, then proposed a therapy that boosts a specific inhibitory signaling pathway in the brain. It picked a brain structure that the scientific literature identifies as the origin point for this type of seizure.

It rejected a second possible target region with a detailed explanation, arguing that the region's effects were too unreliable and had failed in one study against the exact seizure type it was supposed to treat. The agent derived its injection coordinates from three scientific papers, cross-checked the reference points, and averaged the values. It also set the injection volume, speed, and wait times on its own.

During the procedure, the agent watched the surgical field through a camera and made 32 observations, Ocana-Santero says. It tracked the injection and reported whether it saw bleeding.

Safety guardrails backfired mid-surgery

A licensed veterinarian approved every irreversible step and held a physical emergency stop that would immediately cut power to all motors, while the setup also enforced fixed limits such as a cap on injection volume that the agent was expressly forbidden from bypassing.

But those safeguards turned against the team. After a connection dropped, the agent detected that its calculated target position was outside the device's physical range of motion and refused to continue, even when restarting calibration did not change its assessment and a third attempt was made.

The agent turned out to be right, because manual adjustments during an earlier pause had thrown off the control system. Ocana-Santero could not persuade it to proceed despite the anesthetized animal on the table and ultimately had to fix the code by hand.

The incident illustrates the AI alignment problem, or how to make AI agents reliably follow human intent. "Frustrating experience but also revealing how much we can come to depend on these models and what happens when they just say 'no' in the middle of a time-sensitive procedure," Ocana-Santero wrote.

Model choice also reflected the alignment challenge, since Sonnet 5 was the only model willing to carry out the live procedure from start to finish. The more capable Claude Opus 5.5 and Opus 5 both refused, with Opus 5 saying it could not guarantee completion and that stopping with a needle in an anesthetized animal's brain would be worse than not starting at all.

First time an AI agent has treated a living animal on its own

Although autonomous surgical robots already exist and are mechanically more precise than his lab device, Ocana-Santero notes that in previous cases a human always chose the surgery while the robot only carried it out. Here, the agent both chose the treatment and brain target and then performed the procedure on a living animal.

"I am not aware of an agent previously choosing a treatment and a brain target and then delivering it into a living mammal," Ocana-Santero wrote. He calls the approach "in vivo lab in the loop," in which AI agents are fully connected to experimental capabilities in the lab, something Anthropic is also working on with its "Model Hardware Standard".

The mouse recovered well, according to Ocana-Santero. A technical report is expected to follow. The results have not been peer-reviewed.

Two recent experiments with the latest large language models showed that they've gained significant capability as control units for robots but that alignment in this role is a problem all its own.

AI News Without the Hype – Curated by Humans

Subscribe to THE DECODER for ad-free reading, a weekly AI newsletter, our exclusive "AI Radar" frontier report six times a year, full archive access, and access to our comment section.