Boards keep asking me the same question about AI agents: when do they stop advising and start acting? A laboratory in San Francisco answered that question this week, and the answer arrived faster than most governance frameworks did.
Gabriel Ocana-Santero, cofounder and CEO of Exin Therapeutics, a startup developing drugs for epilepsy and neurodegenerative disease, connected an AI agent to a custom-built surgical rig. The rig could immobilise a mouse, watch the procedure through a camera, move an injection needle and control the delivery of a compound. Then his team stepped back.
The agent, running on Anthropic's Claude Sonnet 5, was given a spreadsheet of nineteen candidate gene therapies and one instruction: reduce this mouse's seizures. It analysed how seizures arise in that model, selected a therapy that boosts a specific inhibitory signalling pathway, chose the brain structure the literature identifies as the origin of this seizure type, and rejected a second candidate region with a written explanation of why its effects were too unreliable. It derived injection coordinates from three scientific papers, cross-checked the reference points and averaged the values. It set its own volume, speed and wait times. During the procedure it made thirty-two observations through the camera, tracked the injection and reported whether it saw bleeding. A veterinary surgeon had performed the craniotomy; everything after that belonged to the agent. The mouse is recovering well.
To my knowledge, this is the first time an AI agent has both chosen a medical treatment and physically delivered it to a living mammal. Surgical robots have been more precise for years, but a human always chose the surgery. This time the machine chose.
The most instructive detail is not the surgery. It is the refusal.
The team first tried Anthropic's more powerful reasoning model, Claude Opus 5.5. It did the experimental planning, then declined to guide the needle. Stopping midway with a needle in an anaesthetised animal's brain, it reasoned, would be worse than not starting. Sonnet 5, the everyday model, agreed to proceed. Read that twice. Capability and caution are separate dials. The most capable model in the room was not the one willing to operate. Any organisation deploying agents into physical or financial systems should treat model selection as a risk decision, not a procurement decision.
The safeguards deserve equal attention, because they were mechanical rather than rhetorical. A licensed veterinarian approved every irreversible step. A human held a physical emergency stop that cut power to every motor. The agent was forbidden from modifying the equipment's underlying code. Midway through, a dropped connection corrupted the rig's coordinate system. The agent detected that its calculated position was outside the device's physical range and refused to continue, three times, even with the animal on the table. The restriction that frustrated the team was the same restriction that prevented a wrong injection. They resolved it with a separate agent that was never told a live surgery was in progress.
That is what a control plane looks like. Not a policy PDF, but layered constraints that hold when something breaks at the worst possible moment.
Three implications for every executive deploying agents beyond the chat window. First, inventory where your agents touch the real world: lab equipment, vehicles, trading systems, industrial controls, patient workflows. If you cannot list them, you do not have governance, you have hope. Second, design for refusal. An agent that says no during a time-sensitive procedure is not a defect; it is the alignment working, and your operating model must absorb that pause without panic. Third, never let the operator agent grade its own homework. Exin needed a second agent, firewalled from context, to repair the first one's tooling. Separation of duties is an old control. It just gained a new domain.
The laboratory of 2030 will pair scientists with agents that have hands. The companies that benefit will not be those with the boldest agents. They will be those whose agents know exactly when to stop, and whose leaders built the stop button before they built the demo.
Think mathematically. Engineer intelligently. Lead strategically. Build responsibly. Scale globally. Create real business value through artificial intelligence.
