An artificial intelligence agent has selected a gene therapy and controlled its injection into the brain of a living mouse with epilepsy, after researchers replaced another model that refused to proceed over safety concerns.

San Francisco biotechnology company Exin Therapeutics says this is the first experiment in which an AI system independently chose both a treatment and its injection site, then administered it to a living mammal. The mouse survived and is recovering well, researchers say. Whether the treatment reduces seizures remains under investigation; the results have not undergone peer review.

The team initially used Anthropic’s Claude Opus 5.5. It planned the experiment but refused to guide the needle into the brain. According to Exin’s chief executive, the model expressed concern that its operation might be interrupted during the procedure, endangering the animal. Researchers switched to Claude Sonnet 5, which proceeded. Anthropic has not commented.

Sonnet chose from 19 gene therapies, selecting one intended to increase the activity of GABA, a neurotransmitter that inhibits and regulates electrical activity in the brain. Increasing that inhibition could theoretically reduce seizures, but therapeutic benefit has not been established here.

After reviewing scientific literature and rejecting one brain region because it judged the evidence insufficiently reliable, the agent selected the lateral entorhinal cortex, previously linked to the seizure type being studied. It used three papers to calculate the injection position, then controlled the robotic arms, needle, dose and delivery rate. The company says it injected 250 nanolitres, or 0.00025 millilitres, over about five minutes.

This was not an autonomous operation from start to finish. A veterinary surgeon opened the skull. Researchers required human approval of the injection plan, installed an emergency motor cut-off and restricted access to equipment-control code.

A coordinate-system fault exposed the importance of those restrictions. The agent detected that its calculated target no longer matched the needle’s reachable position but would not alter code it was forbidden to change. A separate agent using Opus 5 made the adjustments without being told that surgery on a living animal was under way.

That was not necessarily a direct circumvention of the earlier refusal. It does, however, illustrate how instructions and context can affect safeguards; different responses do not establish that either model possesses a conscience.

Exin argues that connecting agents to laboratories could help them learn from failed experiments and practical adjustments absent from published research. It is testing other models, including xAI’s Grok, and systems for opening skulls, though researchers are not ready to entrust that step to AI in a living animal. The demonstrated capability is robotic experimental execution, not an established treatment for epilepsy.