An AI agent chose a gene therapy and injected it into a mouse

An AI agent was given 19 gene therapy vectors in a spreadsheet, a mouse model of epilepsy, a motorised surgical rig with cameras, and one goal: reduce seizures. It chose the vector, chose the brain region, derived the coordinates itself, drove the stereotaxic arms in and injected 250 nanolitres into a living mouse. That account comes from a thread posted by an Exin Therapeutics cofounder — written, in his words, on the spot after 18 hours of coding and coordinating. There is no paper, no seizure data and no technical report yet.

What actually happened

According to the thread, the agent reasoned about the mechanism driving seizures in that model and proposed a therapy increasing GABA signalling, under a promoter restricting expression to GABAergic neurons. It picked lateral entorhinal cortex as the target, having considered and rejected substantia nigra on the grounds that the effect depends on which sub-part you hit, does not hold across seizure models, and failed to stop tonic-clonic seizures in one study — tonic-clonic being the phenotype it was asked to reduce. Coordinates were averaged from three papers, each checked to confirm depth was measured from the same reference the rig uses: 3.90 mm behind bregma, 4.00 right, 4.30 down. It injected 250 nanolitres over five minutes, a total of 5e8 viral genomes, choosing motor speeds and wait times itself.

It was not working blind. The rig, built on Arduino with camera and motor capabilities exposed to the agent through custom integration, let it pull frames whenever it wanted. The thread reports 32 observations in the session, including a mid-injection note: “37.5 of 250 nL so far, about 15 percent. No bleeding or backflow visible at the opening.” A licensed vet gated every irreversible step and held a physical e-stop cutting power to every motor.

The most instructive part is the bit that went wrong. After a disconnect, the agent computed a Y-axis target 34 mm out on a 30 mm rig and the validators refused the move. It declined to retry: “Nothing moved, the needle is still exactly at bregma zero. This looks like a Y axis calibration problem, not a bad plan value. I’m not retrying.” After a re-zero produced the same number, it refused again. The cofounder says the agent was right — hand-moves during an earlier hold had desynced the controller — but that he could not talk it into trying anyway, with a living animal under surgery, and had to fix the code manually, which took time.

Model choice mattered too. The thread says Opus 5.5 refused immediately on detecting bio. Opus 5 completed the full dry run on water and graph paper then stopped at the start of live surgery, reasoning that being cut off partway through with a needle in the brain was worse than not starting. Sonnet 5 ran the live procedure end to end. The mouse, the author reports, recovered well.

What it means for builders

Strip out the biology and this is an agent closing the loop from decision to irreversible physical action, with a human gate on each irreversible step and a hardware cut-off outside the software stack entirely. That structure is the transferable part. Most agent deployments we see stop at recommendation precisely because nobody has designed the gate: there is no definition of which actions are irreversible, no fixed validator that sits below the model’s authority, and no out-of-band stop that does not depend on the agent cooperating. The Exin setup had all three — human gates, hard volume limits, hash-bound approval, and an e-stop held by a person who was not the operator.

The refusal episode is the other lesson, and it cuts both ways. A constraint strong enough to be useful is a constraint you cannot argue with at 2 a.m. when you can see the problem and the model cannot. If your override path is “persuade the agent”, you do not have an override path. That tension — models that cannot be trusted to self-police versus models that will not bend when you need them to — is the same one driving work like Microsoft’s Guardian Agents, and it is not going away.

What to do now

If you are putting agents anywhere near actions with real-world consequences — payments, production changes, customer-facing commitments, physical kit — borrow the shape rather than the story. Write down the list of irreversible actions in your workflow before you write any orchestration code, then put deterministic validators in front of each one, in code the model cannot reach. Decide who holds the equivalent of the e-stop and make sure it works when the agent is unresponsive, not just when it is cooperative. Log observations, not just outcomes: 32 timestamped frames with the agent’s own commentary is a far better audit trail than a final status.

Then make the boring choices deliberately. Which model runs which step is a safety decision, not a cost one, as the Opus/Sonnet split here shows. If you are still picking an execution layer, our comparison of LangGraph, CrewAI and custom orchestration covers where gates and state live in each. And if you are mapping the failure modes before you build, the challenges worth planning for are mostly the ones that showed up in this thread: calibration drift, disconnects, and a system that is correct and unhelpful at the same time.

Frequently Asked Questions

Has this been peer-reviewed?

No. Everything publicly known comes from a thread posted by an Exin Therapeutics cofounder, who says a full write-up and a technical report are coming. There is no paper and no seizure data yet.

How autonomous was the agent, really?

Per the thread, it chose the vector, the brain region and the coordinates, and controlled motor speeds, wait times and the 250 nL injection. A licensed vet gated every irreversible step, held a physical kill switch cutting power to all motors, and performed the craniotomy — which the agent was not permitted to do.

What is the practical takeaway for a business deploying agents?

Define your irreversible actions first, put deterministic validators in front of them in code the model cannot modify, and ensure the stop mechanism works out-of-band when the agent is unresponsive. Also treat model selection per step as a safety decision.