Who Gave the AI Control of the Laboratory?

30 Aug, 2026

A common interface makes laboratory instruments easier to operate. It does not decide who should be allowed to change the experiment.

At Genentech, researchers pointed Claude at the bicinchoninic acid assay, a routine measurement of protein concentration that requires a liquid handler, a robotic arm and a plate reader to work in sequence. The model hit an error caused by bubbles in a viscous protein solution. Its response was to retry the operation in the same well with different parameters, which agitated the fluid further and produced more bubbles. Researchers had to tell it that the error code described a physical condition rather than a software fault, and that the fix was to move to a clean well and mix less. Once told, it held that context for the rest of the run. A different partner, working the same preview, would later let an agent discard a plate and change a concentration range on its own, and would report it as a success.

The failure is more instructive than the recovery. Retrying a failed operation is often the right response, and here it aggravated the physical condition that had caused the error in the first place. Genentech's account, published as part of Anthropic's announcement on August 27, 2026, is candid about the limitation: general reasoning does not confer physical intuition, and the gap shows up exactly where an agent is deciding what to do next.

The announcement introduces the Model Hardware Standard, a specification that lets AI agents discover and operate laboratory and manufacturing instruments through a common driver. The driver exposes a small set of primitives, commands to read a value or write one, and publishes a description of each device covering what it measures, what can be adjusted and what limits apply. Agents reach it through the Model Context Protocol, a command line interface or code files. The project began as a collaboration between Alek Kemeny at Anthropic and Arco Bast, a postdoctoral scientist at HHMI Janelia Research Campus, and grew out of Bast's method of putting an entire microscope rig's state into a shared memory dictionary.

Status matters here and is easy to overstate. MHS is a research preview, available by application, and Anthropic states that it will open-source the standard after further work on safety evaluations, which is also an acknowledgement that the specification is not yet released. No conformance suite or independent security evaluation could be located in public sources at the time of writing. A project with "Standard" in its name is not yet a ratified standard, and the available evidence supports an account of what the preview demonstrated rather than a judgment on how the implementation behaves.

Why laboratories want this

The appeal is not subtle, and the reported numbers are the kind researchers notice. At Carnegie Mellon, a team automated a serial dilution dose-response protocol across a liquid handler, a plate reader, a robotic arm and monitoring cameras distributed over 3 computers with incompatible interfaces, one of which drove a plate reader through its graphical interface because the software has no programmatic access at all. Building the drivers and running to a completed dilution curve took about 8 hours, against the several weeks a vendor integration typically takes. At the University of Washington, the doctoral student Zihao Song connected 6 instruments in under a week, including the time spent writing their drivers, after earlier automation attempts had consumed weeks and been abandoned.

Behind those figures sits a real and unglamorous problem. Laboratories already own capable machines. What they lack is an economical way to make the machines work together, and the cost of that coordination has historically scaled with the number of devices. Song's description of the underlying economics is worth attention: designing a protein computationally can cost about $0.01, and testing one at the bench costs roughly $100 and a week of labour, against 1,000 candidates tested at a time. Automation that only pays for itself at industrial scale leaves most of biology doing things by hand.

Laboratory interoperability standards already exist, and an essay that treats MHS as arriving into a vacuum will be wrong on the facts. SiLA 2 is a mature open standard for instrument connectivity with typed, machine-readable capability descriptions and network discovery. OPC UA LADS, released in January 2024 as a manufacturer-independent companion specification, models laboratory and analytical devices including information such as calibration status, and adoption is free. Autonomous AI-directed experimentation is not new either: Boiko and colleagues published Coscientist in Nature in December 2023, a GPT-4 system that designed, planned and executed experiments across 6 tasks including the optimisation of palladium-catalysed cross-couplings.

The defensible novelty claim is narrower and more interesting than "first." Authors proposing a rival agent-to-instrument protocol argue that SiLA 2's capability descriptions are fixed at design time, with no runtime negotiation, no way to express physical safety limits or hazard classes per capability, no concept of exclusive resource reservation, and no provision for a probabilistic agent at all. The assessment comes from a competing effort and should be read as such, and the underlying observation is not controversial: existing standards were built for orchestration by a workflow engine, which can branch on measurements but works from a repertoire of actions fixed before the run. The new question is what changes when the client chooses its actions at runtime, and the sources reviewed here do not establish a comparative advantage over what already exists.

The strongest result, and what it actually shows

QuEra Computing produced the most quantitatively developed case. Its neutral-atom quantum computers depend on lasers held to roughly one part in a trillion, and recovering a lost lock has traditionally required a specific expert, sometimes driving to the laboratory at night. An existing hand-written recovery script succeeded about 58% of the time and took around 150 seconds. QuEra gave the same problem to Claude through MHS on a dedicated testbed, with the agent in operational control of roughly $0.7M of precision hardware inside human-set bounds, running unattended overnight.

The resulting controller recovered the correct lock 695 times out of 700 across 7 disturbance classes, a 99.3% success rate, in 0.9 to 5.4 seconds for the easier faults and 10 to 14 seconds for the hardest, against 5 to 10 minutes for a human. The 5 misses shared a single rig-condition cause, and in each the controller declined to claim success rather than reporting a wrong lock as a correct one, which is the failure mode that matters. Over the pilot the laser also hopped modes on its own 43 times, and all 43 recovered automatically.

Two distinctions in QuEra's own account deserve preserving, because they are the difference between a governance story and a marketing one. What runs on the bench is a deterministic, inspectable Python script, and the deployed recovery logic runs without a language model making each decision. MHS was the environment in which the model developed and validated that script. The separate tuning workflow, which reduced residual noise and eliminated lock drops across a 19-hour soak test, still has the agent in the loop. Autonomy in development and autonomy in operation are different arrangements, and evidence about one does not transfer to the other.

Two smaller discrepancies are worth flagging for anyone citing these figures. Anthropic's announcement says the earlier QuEra recovery script took a team of 4 specialists several months to build; QuEra's own post says roughly 2 to 3 weeks. Anthropic reports the tuning result as roughly 10 times quieter on the servo's RMS error measure; QuEra reports residual frequency noise cut by a factor of 5. The second pair may describe different quantities honestly, and the announcement does not say so.

Permission to operate an instrument is not permission to change the experiment

The Carnegie Mellon result is the one that should give an institution pause, and it is presented as a success rather than a concern. The team first induced 6 fault conditions, including a missing plate, a rotated plate and an active emergency stop, and the system blocked all 6 before any device moved.

The agent then ran the dilution protocol, using a colorimetric dye as a stand-in for a real drug candidate so that the demonstration stayed safe and visible. It judged the resulting curve too poor to accept because saturation at high concentrations had driven the fit below an R² of 0.9, discarded the plate, and reran on a fresh one with the top concentration reduced from 200 to 100 µg/mL. The second run produced a strong fit, and the team's report states plainly that there was no human input at any point.

The workflow was built to behave that way. Carnegie Mellon describes the agent evaluating the curve and deciding whether to adjust the range as part of the intended design, so the discretion was granted rather than seized, and an expert would probably have made the same call. The demonstration therefore establishes delegated experimental judgment. What the published account does not describe is how the boundary of that delegation was set and approved: which parameters the agent could vary, what materials it could spend, and at what point a departure would have required a person. Judgment about whether a measurement is good enough, authority to consume a fresh plate, and the power to change an experimental parameter mid-campaign are 3 separate grants, and the boundary between them is the governance artifact rather than the interface.

Compare the University of Washington qPCR case, where the arrangement is different in exactly the way that matters. The system watches the amplification curve, identifies the pattern, and asks the researcher whether to stop or continue. When told to stop, it halts the reaction and advances the instrument to a 4 °C hold. The agent is doing the watching, which is the tedious part, and a person is making the call. Same standard, same class of instrument, materially different delegation. The interface does not determine which arrangement a laboratory gets. Somebody has to choose.

Two limits collapse under a single well-designed interface and are worth holding apart. A machine can stay inside its declared operating range and an agent can still exhaust a unique sample, alter a comparison group or invalidate a planned analysis, because equipment protection and research quality are different controls answering different questions. The same applies to the commands themselves: monitoring an existing telemetry stream differs from initiating a measurement that consumes material or exposes a specimen, and a command labelled "read" is not automatically harmless. The physical effect is what needs classifying, not the software label.

Device-level enforcement is the part MHS appears to get right, and the partners describe it consistently. Virginie Ruetten, a Janelia scientist whose zebrafish imaging rig runs through the standard, notes that MHS enforces device-level safety limits, so an agent cannot accidentally apply excess laser power and bleach a sample. QuEra states that declared bounds, interlocks and emergency stops are enforced at the hardware interface independently of the model. Enforcement that does not depend on the agent's reasoning being correct is the right architecture, and it is also a boundary around equipment rather than around experiments.

A promise that a human stays in the loop settles less than it appears to. The question is whether that person receives the relevant evidence, has time to evaluate it, understands the alternatives and can actually refuse.

QuEra's account contains the failure mode from the other direction. Claude often stopped to wait for human confirmation before any action it judged even slightly risky, so experiments sometimes paused overnight and waited for approval nobody was there to give. QuEra's own view is that an overly cautious agent beats an insufficiently cautious one, which is right. An approval requirement that blocks the action until a person answers is a functioning control, and it is also a limit on unattended progress, which is a real cost when the point of the arrangement was overnight operation. Requiring approval for every routine step also risks producing a person who approves by reflex, and the risk is worth designing against rather than treating as inevitable.

Bounded delegation is the more credible design: preauthorise a defined procedure and a resource budget, then escalate meaningful departures. The hard part is that a laboratory has to decide what counts as a meaningful departure before unattended operation starts, and the Carnegie Mellon rerun is precisely the case that would need classifying in advance.

An experiment can drift even when every machine behaves

Injury and equipment damage are the obvious risks. Scientific validity can also suffer without either occurring, because a system can produce an orderly sequence of measurements as the meaning of the experiment changes underneath it.

Tetsuwan Scientific's report supplies an unusually honest illustration. The company ran a closed-loop campaign to improve its compiler's model of pipetting precision, testing 9,143 individual dispenses across 300 transfer types and 1,508 measured conditions. On analysing the data, roughly a third of the variation they had been measuring turned out to come from plate-edge evaporation rather than from any pipetting effect. The effect is well understood and they were surprised by its size. Most of the effort in the project, by their own account, went into experimental loop design rather than into the model, and it took a series of specific corrections, blanking, prefilling wells to constant volume, masking bubbles, randomising dispense order, to make the measurement mean what they thought it meant.

Tetsuwan also reports something the announcement's version of the same story omits. When a camera detected bubbles in a reagent tube, the recovery involved sealing the plate, prompting a human operator over Slack to carry it to an off-deck centrifuge, spinning it, and prompting the operator to carry it back. The announcement describes the agent locating a centrifuge on the network and issuing commands to it. Both accounts are true. Only one of them tells you that a person walked across the room in the middle of the autonomous recovery.

The 2 accounts of Tetsuwan's headline statistic also disagree. Tetsuwan reports the refined model beating the manufacturer's datasheet on 33 of 45 held-out sessions at a sign test of p ≈ 0.003, close to the 0.0025 an exact 2-sided test on 33 wins returns. Anthropic reports 31 of 45 at p ≈ 0.001, where 31 wins from 45 yields roughly 0.008 one-sided or 0.016 two-sided. The counts and the significance figures need reconciling, and the published summaries alone cannot establish which record is correct. The underlying finding, roughly 12% better prediction than the datasheet, is consistent across both, and nothing here suggests bad faith. Institutions delegating experimental authority to software will nonetheless need records that settle such questions rather than raise them.

The remedy is not to forbid adaptation. Adaptive research is legitimate and often necessary. The requirement is that adaptation follow an approved method, that its consequences be understood, and that a later reader be able to reconstruct what happened. That means preserving the approved design, the actual execution, sample identities, calibration state, software and driver versions, parameter changes, failure events, approvals and analysis revisions. A transcript of the agent's conversation is not evidence of what the instruments physically did.

What institutions should ask before granting autonomy

An earlier post here argued that context engineering is governance at inference time, because institutions decide which information and policies an agent treats as authoritative. The laboratory adds a harder requirement. Permissions have to constrain action even when the agent's interpretation of its instructions is wrong, because the consequence is a consumed sample or a damaged objective rather than a bad paragraph. A related essay asked what happens when science becomes faster than peer review. The present question arrives earlier in the chain, during the experiment rather than after it.

Before granting an agent unattended operation, an institution should be able to name, for its own setting, who approves the scientific question and procedure, which instruments and samples fall inside the grant, what physical combinations are prohibited, who issues and revokes access, who reviews departures from the procedure, who can interrupt a run, and who investigates a disputed result afterwards. Those are not universal legal assignments and organisations divide them differently. The test is whether the names exist before the run starts.

The strongest counterargument deserves stating plainly, because governance can preserve bad processes as easily as good ones. The right comparison is not an imperfect agent against an imaginary flawless human. It is a proposed automated workflow against the actual current one, including its failure rate, its delays, its staffing cost and the 4 a.m. plate changes that Song described. Explicit permissions and better records can reduce that friction rather than adding review meetings, and a well-defined operating envelope makes useful autonomy easier to authorise rather than harder.

What better evidence would look like is not mysterious. All trials and their exclusions, with the distribution of failure types and the amount of human intervention each one required, rather than the successful runs alone. And for safety, tests of rejected commands, conflicting actions, stale state and revoked access, reported against their own denominators rather than folded into a task completion rate. A polished demonstration can establish feasibility without measuring routine reliability, and the preview's partners have been notably willing to say so themselves.

The institution must be able to explain who authorised the action, what limits applied, and what actually happened. A standard can help enforce the permissions and preserve the record. Deciding which decisions to delegate, and who answers for them afterwards, is not something an interface will do on a laboratory's behalf.

My blog