OpenAI has described Control Room, a central system that tracks model workloads across its research infrastructure and can stop them when safety or security concerns arise. The company published the details on November 9, 2026, and says the system is already deployed across its research infrastructure.
The headline number is 35 seconds. OpenAI says that is the maximum time between Control Room receiving an instruction to stop a job and the moment when further progress is no longer possible.
OpenAI framed the reason in one sentence: "As our models get more powerful and the associated safety and security risks become bigger, it becomes more and more critical that we can detect potential issues, and quickly stop models in their tracks when needed."
What is Control Room?
Control Room is a permission check that sits between research jobs and the models they use. According to OpenAI, it connects every research inference workload, "including agentic sampling for model training and evaluation, data processing, and more." It works together with OpenAI's misalignment monitoring systems.
OpenAI also says it requires every research workload that does agentic inference to be associated with an approved safety case.
The system has three parts, in OpenAI's terms:
- The workload. The job being run, such as a reinforcement learning experiment, an evaluation, a high-volume sampling or data processing job.
- The inference engine. The model itself, running directly on GPUs. OpenAI calls it "the brain of the model."
- The Control Room service. It tracks jobs and controls whether they are allowed to continue generating model output.
Control Room covers research. OpenAI says its external model-serving stack "is already much more centralized by nature, with a well-developed operational capability to quickly take down model deployments if needed."
How does a stop work?
The flow is simple. When a job starts, its code asks Control Room for a job ID. Every time the job wants output from a model, it sends a request to an inference engine and includes that job ID. Before answering, the engine asks Control Room whether the job is still allowed to run.
If a person or a monitoring system has told Control Room to stop the job, Control Room denies the request. The engine then returns a refusal instead of model output.
Two details matter here. First, the job's own code may keep running; it just cannot get any more model output. Second, the engine stays available to other jobs that are still authorized. The stop is aimed at one job, not the whole machine.
Where do stop decisions come from?
OpenAI says all of its frontier reinforcement learning jobs run with a monitor. A monitor is another model that inspects everything the model being trained is doing and raises an alert if it detects a problem. OpenAI says its recent DNS-related incident was caught by a monitor.
Depending on the details and severity, the monitoring system may decide to stop the job. It sends the job ID to Control Room, which records the job as terminated. The next request for more model output from that job is denied.
This ties Control Room to OpenAI's wider work on watching model behavior. We covered that work recently in OpenAI's finding that models are becoming harder to monitor through their chain of thought and in its research on covert underperformance.
Why 35 seconds and not zero?
OpenAI says the 35-second lag comes from a caching layer for inference authorization, which is needed "to support the required volume of traffic."
The company says: "We are working to drive this number down to zero so that we can end jobs instantly."
Note what the window measures. OpenAI defines it from the moment Control Room receives the stop instruction. Spotting a problem and deciding to act happen before that.
Why put the stop in the inference layer?
OpenAI says workload code is owned by researchers and changes often, so it "is not an ideal place to implement critical load-bearing safety protections." By contrast, there are "only a very small number of inference code paths in use across all of OpenAI research."
That makes the inference layer a bottleneck that every research model call passes through. OpenAI says this gives it strong guarantees that all research inference is subject to Control Room checks on every request. The company also runs "continual agentic and programmatic sweeps" to check that nobody is "accidentally or maliciously" launching rogue engine implementations with Control Room unimplemented or disabled.
What does "fails closed" mean?
A system that fails closed blocks everything when it breaks, instead of letting everything through. OpenAI says that if the Control Room service goes down, "either due to a system error or because it is disabled for any other reason, including tampering by a bad actor," all inference requests are denied until it resumes normal operation.
Per the November 9 post, fail-closed was already rolled out to all frontier model research workloads, and OpenAI said it would finish rolling out across all remaining research workloads "over the next few days."
Is it a "kill switch"?
Some outlets, including Interesting Engineering and The Indian Express, described Control Room as a kill switch. OpenAI's post does not use that phrase. It describes a central system to track model workloads and stop them, applied to research infrastructure.
It is also not a full shutdown of a job. It cuts off model output for a stopped job, while the job process and the engine can keep running.
What comes next
OpenAI calls Control Room "just one part" of its approach to safe frontier model training and deployment. It says it will continue to strengthen and expand the system over the coming months, alongside its investments in monitoring for misaligned behavior and security breaches.
Questions about how labs handle agent incidents are also coming from regulators. Earlier this month the EU's AI Office asked OpenAI and Anthropic for more on AI agent incidents.
