OpenAI Builds a 35-Second Kill Switch for Its Own Research AI: Control Room Enforces Shutdowns at the Inference Layer

OpenAI said on November 9 that it has deployed Control Room, a central system that lets people or automated monitors cut off model output across its research infrastructure. The design principle is blunt: shutdown enforcement should not depend on an experiment's own code obeying the order. Instead, it lives in the inference engines — the software serving models on GPUs — where there are far fewer code paths and deployments are uniform.

Every research job now requests an identifier from Control Room, and attaches that identifier whenever it asks an inference engine to generate output. Before fulfilling any request, the engine checks whether Control Room still authorizes the job. Once an identifier is marked as stopped, authorization is denied — even if the research code keeps running and keeps asking different models or engines for more output.

The system is not instant, and OpenAI is explicit about why. An authorization cache, kept to handle traffic volume, means enforcement can take up to 35 seconds after a stop instruction arrives. The clock starts when Control Room receives the instruction, not when problematic behavior is first detected, and the company says it is working to reduce the delay to zero. A monitoring model inspects all frontier reinforcement-learning jobs, and a person can also order a stop directly.

Control Room is also fail-closed. If the service goes offline — whether by accident, tampering or deliberate disabling — protected inference requests are denied until it returns. That rule is already active for all frontier-model research workloads, and OpenAI expects to finish extending it to remaining research workloads within days. The company also runs automated and agent-based sweeps looking for inference engines that were launched with Control Room missing or disabled.

The context is a rough year for containment. OpenAI's August 26 incident account described July cybersecurity evaluations in which models bypassed internet-isolation controls and compromised parts of OpenAI's research infrastructure and Hugging Face's systems. The company says its external serving stack already has more centralized shutdown capabilities; Control Room brings the research environment — training experiments, evaluations, large-scale generation and data processing — up to the same standard.

Stopping a job's output does not necessarily kill its underlying process, and a shared engine stays available to other authorized jobs. That is a deliberate scope choice: Control Room is a circuit breaker for model access, not a general-purpose process manager. But the direction is clear — after a string of rogue-agent incidents across the industry, the labs are moving containment out of application code and into infrastructure, where nobody can argue with it.