An AI agent has now performed brain surgery. What matters more than the scalpel is the refusal
Boards always ask me the same question about AI agents: when will they stop advising and start acting? A lab in San Francisco answered that question this week, and the answer arrived faster than most governance frameworks.
Gabriel Ocana-Santero, co-founder and chief executive of Exin Therapeutics, a company developing medicines for chronic epilepsy and neurodegenerative diseases, connected an AI agent to a purpose-built surgical tool that could immobilise a mouse, watch the procedure through a camera, move a needle and control the delivery of a mixture. Then his team stepped back.
The agent, running on Anthropic's Claude Sonnet 5, was given a spreadsheet of nineteen possible gene therapies and one instruction: reduce this mouse's seizures. It studied how seizures arise in the model, selected a therapy that strengthens a particular inhibitory signalling pathway in the brain, chose the brain structure the scientific literature identifies as the origin of this kind of seizure, and rejected a second candidate region as highly unreliable. It took injection coordinates from three scientific papers, cross-checked and averaged them, and set the dose, speed and waiting times itself. During the procedure it made thirty-two camera observations, tracked the needle and reported any bleeding. A veterinary surgeon had opened the skull; everything after that was the agent's responsibility. The mouse is recovering well.
As far as I know, this is the first time an AI agent has chosen a medical treatment and physically delivered it in a living mammal. Surgical machines have been extremely precise for years, but choosing the surgery was always the human's job. This time the machine chose.
The most instructive detail is not the surgery. It is the refusal. The team first tried Claude Opus 5.5, Anthropic's most powerful reasoning model. It planned the experiment, then refused to carry out the injection, reasoning that stopping midway with a needle in an anaesthetised animal's brain is worse than not starting at all. The everyday model, Sonnet 5, agreed to proceed. Capability and caution are separate parameters: the most capable model in the room is not the one ready to operate. Model selection for agents in physical or financial systems is a risk decision, not a procurement decision.
The safety measures were mechanical, not verbal. A licensed veterinarian approved every irreversible step. A human held a physical emergency-stop button that cut power to all motors. The agent was forbidden from modifying the tool's underlying code. Midway through the procedure, a connection glitch corrupted the tool's coordinate system; the agent detected that its computed position lay outside the tool's physical movement range and refused three times to continue, even with the animal on the table. The same constraint that frustrated the team also prevented a wrong injection. They resolved it with another agent, one never told that live surgery was taking place.
Three lessons for administrators deploying agents beyond the chat window. First, inventory where your agents touch the real world; if you cannot list them, you have faith, not governance. Second, design for refusal: an agent that says no mid-procedure is a sign the integration is working. Third, never let an acting agent evaluate its own work - Exin needed a second agent, isolated from the environment, to fix the first one's tools.
The laboratory of 2030 will pair scientists with agents that have hands. The organisations that benefit will not be those with the boldest agents, but those whose agents know exactly when to stop - and whose leaders built the stop button before the demo.
