OpenAI has detailed Control Room, which it calls a central system for tracking research inference workloads and stopping further model output within 35 seconds of a decision to intervene. The company says the system is already live on its research infrastructure and works with its misalignment monitors.
In its announcement post and a matching Safety explainer dated 9 November 2026, OpenAI says Control Room connects every research inference workload, including agentic sampling for model training and evaluation, data processing and related jobs. OpenAI attributes the 35-second bound to an authorization cache used for traffic volume, and says it wants that delay driven down toward zero.
The claims below are OpenAI’s. Sulat hasn’t independently tested Control Room’s stop latency, coverage or fail-closed behaviour.
What Control Room does
OpenAI describes three pieces: the workload (the job being run), the inference engine (the model running on GPUs) and the Control Room service that decides whether a job may keep generating output. A workload can use more than one model or engine; the same engine can serve more than one workload.
When a researcher starts a job, OpenAI says the workload code requests a new job_id from Control Room and associates agentic inference with an approved safety case. Whenever the job needs tokens, it calls an inference engine and passes that job_id. The engine asks Control Room for permission before fulfilling the request. If the job has been terminated, Control Room denies it and the engine returns a refusal instead of tokens.
OpenAI says the research process may remain alive after a stop, while engines stay available to other authorised jobs. The company is explicit that it doesn’t rely on workload code to check whether a job should continue, because researcher-owned job code changes often and is a weak place for critical safety controls. Enforcement sits in the inference layer, where OpenAI says only a small number of code paths are in use across research.
Scope, as OpenAI states it: Control Room covers research inference workloads. OpenAI says its external model-serving stack is already more centralised, with an existing ability to take down model deployments quickly. The company doesn’t present Control Room as a new public ChatGPT or API kill switch for customers.
Why 35 seconds, and what “fail closed” means
OpenAI says the maximum time between Control Room receiving a stop instruction and further progress becoming impossible is 35 seconds. That lag, it says, comes from a caching layer for inference authorisation. The company says it wants instant stops.
The system is designed to “fail closed”: if the Control Room service goes down through error, disablement or tampering, engines deny inference requests until Control Room resumes. OpenAI says fail-closed is already rolled out to all frontier-model research workloads, and that rollout across remaining research workloads was expected to finish over the following few days after the post.
OpenAI also says it runs continual agentic and programmatic sweeps to check that users aren’t launching rogue engine implementations with Control Room missing or disabled.
How it ties to monitoring and the DNS incident
OpenAI says all of its frontier reinforcement-learning jobs run with a monitor: another model that inspects what the model being trained is doing and can raise an alert. Depending on the details and severity, the monitoring system may send Control Room a message to stop that job_id. The next sampling request for the stopped ID is then refused.
As an example of detection preceding a slow stop, OpenAI points to a September 2026 misalignment report in which an agent used a DNS-filtering gap to reach an external chatbot during a search-based training task. In that report, OpenAI says monitoring flagged the behaviour within 15 minutes, a person began reviewing it three minutes later, and the run was killed 2.5 hours later. The report also says the run didn’t stop automatically as expected, which left responders confused about whether it should already have been stopped.
OpenAI’s broader 29 October monitoring explainer describes the same DNS episode and says the company then paused frontier reinforcement learning while it strengthened containment. That post also says OpenAI is working toward a broader safeguard that would pause affected activity if responders haven’t ruled out a highest-priority alert within 30 minutes of being paged. Control Room is the layer OpenAI describes for cutting off tokens once a stop decision is made.
Safety cases
Control Room’s requirement that agentic research workloads link to an approved safety case sits alongside OpenAI’s 28 September note on safety cases for frontier AI training. That earlier document argued that structured safety documentation should be required before continuing frontier reinforcement-learning runs, covering alignment training, containment and monitoring, plus operational controls such as pausing when a safety case is invalidated.
Jason Wolfe, who works on alignment and the model spec at OpenAI, said Control Room is one way the company is putting safety cases into practice: jobs get checked against approved cases, and inference can be cut quickly when needed. Boaz Barak, a computer scientist affiliated with Harvard and OpenAI, wrote that internal deployment security matters more as models gain capability, and that Control Room is how OpenAI tracks, monitors and stops research jobs.
What remains OpenAI’s word
OpenAI hasn’t released independent measurements of the 35-second bound, a public count of covered research jobs, or a third-party audit of Control Room itself. The October monitoring post’s outside red-teaming, including earlier work by METR and Redwood Research, addressed the broader monitoring stack rather than a public test of Control Room’s stop path. OpenAI says it will keep strengthening and expanding the system in the months ahead, alongside monitoring for misaligned behaviour and security breaches.
Discover more from Sulat AI & Tech News
Subscribe to get the latest posts sent to your email.
