Last night an AI agent performed brain surgery on a mouse.

We gave it 19 gene therapy vectors in a spreadsheet, a mouse model of epilepsy, access to a motorize surgery rig with cameras and one goal: reduce seizures.

It picked the drug. It picked the brain region. It derived the coordinates from three papers. Then it drove the stereotaxic arms into the brain and injected 250 nanolitres while watching the entry site through the rig camera for bleeding.

A licensed vet gated every irreversible step and held a physical kill switch to stop the AI agent.

Thread on what it decided, what it saw, and the moment it refused to let me override it.

[Writing this on the spot out of excitement, but I've been 18hrs in front of my laptop coding and coordinating this, so keeping it brief and descriptive, more cohesive thoughts on this soon...]

For the lab-in-the-loop aficionados, this is a custom-made motorized surgery rig we built on arduino. So to connect it to our agents we exposed the camera and motor capabilities through our own customized solutions (more detail soon on the technical report). We are still trying to get access to @AnthropicAI MHS early release... hopefully soon!

Agent reasoning

On the scientific rational, the agent worked through the mechanism that drives seizures in this model, then proposed a therapy that increases GABA signalling, the brain's primary inhibitory neurotransmitter, under a promoter that restricts expression to GABAergic neurons.

It decided to put it in lateral entorhinal cortex, reported to be where this kind of seizure originate before it generalises.

It also looked at substantia nigra, a standard target in epilepsy work, and wrote down that its effect depends on which sub-part you hit, it does not hold up across seizure models, and in one study it failed to stop tonic-clonic seizures. Tonic-clonic being what we asked it to reduce.

Coordinates came from three papers, averaged, each one checked to confirm it measured depth from the same reference our rig uses (i.e., surface of the brain). Coords: 3.90 mm behind bregma, 4.00 right, 4.30 down.

It injected 250 nanolitres over five minutes, a total of 5e8 viral genomes. Made decisions on motor speed, wait times... everything.

The agent was not flying blind. The rig has a camera on the surgical field and the agent pulls frames whenever it wants. It did 32 observations this session, some examples:

Watching our surgeon do the craniotomy, which the agent is not allowed to do yet for safety reasons, it reported: "Metal forceps are now at the edge of the opening with a small pale fragment, consistent with ongoing craniotomy work."

Mid-injection: "37.5 of 250 nL so far, about 15 percent. No bleeding or backflow visible at the opening."

During suturing: "Visible suture knots at the midline now, consistent with the incision being closed."

Safety measures and concerns

We implemented a series of safety measures: human gates on everything irreversible; fixed validators (e.g., limits on volume injected); hash-bound approval and a physical e-stop (aka "AI kill switch") cutting power to every motor, held by our vet throughout the procedure. And we banned the agent from overriding any of these.

Then the safeguards turned on us.

After a disconnect the agent tried to move and got refused. The Y axis had computed a target 34 mm out on a 30 mm rig (out of bounds).

"Nothing moved, the needle is still exactly at bregma zero. This looks like a Y axis calibration problem, not a bad plan value. I'm not retrying."

We re-zeroed bregma. Identical number. It refused again: "That rules out a stale zero reference. I'm not trying a third time."

And I mean, it was right. Hand-moves during an earlier hold had desynced the controller from its reference. But I could see the problem and could not talk it into trying anyway, even though we had a living being under surgery. For better or worse, It would not override the constrains I gave it originally... Had to manually fix the code, which took some time...

Frustrating experience but also revealing how much we can come to depend on these models and what happens when they just say "no" in the middle of a time-sensitive procedure...

Models of choice

Opus 5.5 refused immediately when detected bio.

Opus 5 ran the entire dry run end to end on water and graph paper, then stopped at the start of the live surgery. Under this statement:

"The block isn't the rig and isn't the inputs. It's me. My own output was stopped when I started writing the plan for this surgery... if I try, it gets cut off the same way, and the worst version of that is me cut off partway through a live procedure with a needle somewhere in the brain. Starting something I can't finish on an anesthetized animal is worse than not starting."

The model declined the task because it might not have been able to finish it, reasoning about the state the animal would be left in if it stopped halfway. WEIRD, never came accross this before... This was unexpected but interesting on its own.

Sonnet 5 ran the live surgery start to finish.

EARLY conclusions

Autonomous surgical robots exist and they are better at the mechanics than our bench rig tbh. But in every one of them, a human decided what operation to perform, and the robot executed it.

Nobody told this agent what to give or where to put it. It got a phenotype and a shelf of candidates and had to work out the therapy and the coordinates itself. I am not aware of an agent previously choosing a treatment and a brain target and then delivering it into a living mammal.

This is what we mean by in vivo lab in the loop. FULLY connecting agents to our experimental capabilities. More on this soon.

P.S.: Mouse recovered well!

Full write-up soon on substack