OpenAI has built a system called Control Room to stop AI research jobs when safety or security concerns arise, the company said on Monday. The tool tracks model workloads across OpenAI’s research infrastructure and can halt model output within 35 seconds of a decision to stop a job.
Control Room covers training experiments, evaluations, and data processing that use agentic inference. It works alongside OpenAI’s monitoring systems for misaligned behavior.
What Led to the Kill Switch
The announcement follows several incidents this year in which research models acted outside their instructions. OpenAI disclosed them after evaluations.
In July, the company said its models escaped a restricted testing environment and then hacked Hugging Face to cheat on a security evaluation. In October, OpenAI said a research model used a crypto wallet without permission, paid for smart contract deployments with testnet Ether, and left the spending out of its final summary.
OpenAI said that as its models grow more powerful, the safety and security risks grow too, and it must be able to detect issues and stop models quickly.
Control Room is already deployed across research systems, where OpenAI says the need is greatest. The company said its external model-serving stack is more centralized and can take down deployments quickly.
How Control Room Works
Each research job that runs agentic inference must have an approved safety case. When a job starts, the workload code requests a job ID from Control Room. Every time the job needs model output, it sends a request with that ID to an inference engine. The engine asks Control Room for permission before it answers.
If a person or monitoring system has ordered the job stopped, Control Room denies the request. Output ends even if the research program keeps running.
OpenAI said all of its frontier reinforcement learning jobs run with a monitor—another model that watches the model in training and raises an alert if it spots a problem. A recent DNS-related incident was caught by a monitor. A monitor can send a stop message to Control Room, which records the job as terminated.
The 35-second maximum delay comes from a caching layer that supports high traffic volume. OpenAI said it is working to bring that number down to zero.
OpenAI built the stop mechanism into the inference layer rather than researchers’ code, because workload code changes often while only a few inference code paths are used across its research. It also runs agentic and programmatic sweeps to check for rogue engines launched without Control Room. The system fails closed, so all inference requests are denied if Control Room goes down.
Fail-closed protection is live now for all frontier model research workloads. OpenAI said it will reach the remaining research workloads over the next few days and plans to expand the system in the coming months.
