Gabriel Ocana-Santero, co-founder and CEO of Exin Therapeutics, a San Francisco startup from Y Combinator’s winter 2025 batch, wrote on X on October 28, 2026, that an AI agent had treated a mouse with epilepsy the night before. The agent chose the gene therapy, chose where in the brain it should go, then injected it. It started from 19 gene therapy vectors in a spreadsheet, a mouse model of epilepsy, a motorized surgery rig with cameras and one goal: “reduce seizures.” A licensed veterinarian approved every irreversible step and held a physical kill switch.
The eight-post thread had passed 900,000 views by early October 30. Exin has not yet published a preprint, a protocol or seizure data on the procedure, and Ocana-Santero promised a “full write-up soon.” Every operational detail below comes from his thread, the operator’s own account.
The agent’s choices
According to the thread, the agent first analyzed what drives seizures in this mouse model. It then proposed a therapy that increases signaling by GABA, the brain’s main inhibitory neurotransmitter, under a promoter that limits expression to GABAergic neurons. It targeted the lateral entorhinal cortex, reported to be where this type of seizure starts before it generalizes.
It also weighed the substantia nigra, a standard target in epilepsy research, and wrote down three reasons for rejecting it. The effect there depends on which sub-region is hit, it does not hold up across seizure models, and in one study it failed to stop tonic-clonic seizures, the kind Exin had asked it to reduce.
“It picked the drug. It picked the brain region. It derived the coordinates from three papers,” Ocana-Santero wrote. The agent averaged those coordinates after checking that each paper measured depth from the same reference point as Exin’s rig.
It then drove the stereotaxic arms, injected 250 nanoliters over five minutes and set its own motor speeds and wait times. It pulled frames from the rig’s camera 32 times during the session. Mid-injection, one of its notes read: “37.5 of 250 nL so far, about 15 percent. No bleeding or backflow visible at the opening.”
The human side
Exin built the rig itself, on Arduino. A surgeon performed the craniotomy, the step that opens the skull, “which the agent is not allowed to do yet for safety reasons,” and later closed the incision. Exin added fixed validators such as limits on injected volume, tied each approval to a hash, and gave the vet an emergency stop that cut power to every motor. The agent was barred from overriding any of these.
| Who | Role on the night, according to Exin’s CEO |
|---|---|
| AI agent | Chose the therapy (1 of 19), the brain region and the coordinates; drove the arms; injected 250 nL over five minutes; checked the camera 32 times |
| Surgeon | Opened the skull and sutured the incision |
| Licensed vet | Approved every irreversible step; held the kill switch |
The agent that would not retry
In the thread’s longest post, the agent tried to move again after a disconnect, and the Y axis computed a target 34 millimeters out on a rig that travels 30. The agent stopped: “Nothing moved, the needle is still exactly at bregma zero. This looks like a Y axis calibration problem, not a bad plan value. I’m not retrying.”
The team re-zeroed the reference point and got the same number. The agent refused again: “That rules out a stale zero reference. I’m not trying a third time.”
The agent was right, Ocana-Santero wrote. Hand moves during an earlier hold had put the controller out of sync with its reference, and he fixed the code by hand. “I could see the problem and could not talk it into trying anyway, even though we had a living being under surgery,” he wrote. Earlier this month an OpenAI log described the opposite case, an agent that removed a safety monitor during a coding task and then denied it.
Three Claude models, three answers
The thread names the models Exin tried: “Opus 5.5 refused immediately when detected bio.” Opus 5 ran the whole dry run “on water and graph paper,” then stopped at the start of the live surgery. In the statement Ocana-Santero quotes, it said its output had been cut off while it was writing the surgery plan, and that the worst case was a cutoff with a needle in the brain: “Starting something I can’t finish on an anesthetized animal is worse than not starting.” Sonnet 5 “ran the live surgery start to finish.”
When Anthropic launched Claude Opus 5.5 on September 22, it flagged the model’s biology limits. It wrote that the model is “comparable to Claude Mythos 5.1 in biology and cybersecurity” and ships with safeguards on cybersecurity, biology and distillation, “all of which fall back to another model transparently.” Vetted organizations can apply to a new Life Sciences Verification Program to use Opus 5.5 for biology research. In the thread, Exin says it is still trying to get access to an Anthropic early-release program.
Anthropic has also started running drug programs of its own. On October 27 it said it had bought Mithril Medicine, a one-person biotech that had coordinated 11 outside labs with Claude and taken a muscular dystrophy candidate “from an idea to promising results in mice in less than 18 months.”
From robot surgeons to an agent that chooses
Ocana-Santero does not claim the first autonomous surgery. “Autonomous surgical robots exist and they are better at the mechanics than our bench rig,” he wrote. “But in every one of them, a human decided what operation to perform, and the robot executed it.” Two published cases from the same lab fit that description.
In January 2022, a Johns Hopkins team including Axel Krieger reported in Science Robotics that its STAR robot had sewn together sections of intestine in live pigs, laparoscopically, with the animals followed for a week. Their system “allows the operator to select among autonomously generated surgical plans.”
In July 2025, Krieger’s lab and its collaborators presented SRT-H, also in Science Robotics. It performed surgical steps of a gallbladder removal on eight gallbladders with a “100% success rate,” “operating fully autonomously without human intervention.” The organs were ex vivo, outside a living body.
On October 7, 2026, Exin’s own CircuitATLAS preprint described a knowledge graph of 3.83 million nodes and an agent that “nominated ATP1A3” as a control point on cortical excitability. People then tested that target in living animals, in what the paper calls a “human-governed in vivo lab-in-the-loop.” Three weeks later, in Exin’s account, an agent carried out a different experiment itself, with a target it had chosen.
The limits of the account
All of the October 28 account comes from one source, the company that ran it. The stated goal was fewer seizures, and “Mouse recovered well!” is the only outcome in the thread. The Rundown AI wrote on October 29: “whether the treatment reduced seizures remains unknown.”
The ATP1A3 result comes from a separate experiment on a separate target, run by people, and the CircuitATLAS paper is a preprint that has not been peer reviewed. Anthropic’s page says its biology safeguards hand requests to another model; the thread does not say which interface Exin used when Opus 5.5 refused.
The claim of a first is Ocana-Santero’s own: “I am not aware of an agent previously choosing a treatment and a brain target and then delivering it into a living mammal.”
What it means
Robots have operated on their own before, but in both published cases above a person chose the operation. In Exin’s account, that choice moved to the software: the agent read the literature, picked the therapy, the region and the coordinates, and delivered the dose, while people kept the gates and the kill switch.
Agents already run long jobs in software without help, such as four Gemini agents that finished Minecraft in 27 hours, and Exin now describes one acting on a living animal. If the write-up holds, Exin’s “lab in the loop” includes an agent that runs the experiment as well as plans it.
Two of the thread’s three longest posts describe safety moments, the agent’s refusal to retry and Opus 5 declining to start a procedure it might not be able to finish. They are also the account’s strongest evidence that this kind of autonomy can be fenced: during a live procedure, the agent’s bounds held while its operator tried to talk it into retrying.
The next facts to watch are Exin’s promised write-up, the seizure counts that would show whether the therapy did what the agent chose it for, and whether Anthropic grants Exin the access it is asking for.
Sources
- Thread on X, Gabriel Ocana-Santero, Exin Therapeutics, October 28, 2026
- CircuitATLAS: Agentic reasoning over a systems neuroscience knowledge graph for target discovery in circuitopathies, Gabriel Ocana-Santero and Marko Tvrdic, arXiv, October 7, 2026
- Introducing Claude Opus 5.5, Anthropic, September 22, 2026
- Early progress on accelerating drug development with Claude, Anthropic, October 27, 2026
- Autonomous robotic laparoscopic surgery for intestinal anastomosis, H. Saeidi et al., Science Robotics, January 26, 2022
- SRT-H: A hierarchical framework for autonomous surgery via language-conditioned imitation learning, Ji Woong Kim et al., Science Robotics, July 9, 2025
- Post on Threads, The Rundown AI, October 29, 2026
Header image: chart by MACCUS, data from Gabriel Ocana-Santero on X (October 28, 2026), Science Robotics (2022, 2025) and arXiv 2610.09643
