OpenAI introduced Control Room, saying the internal system can stop output from a research model within 35 seconds of an instruction to halt its job. Deployed across the company’s research infrastructure, it tracks work that calls on models and gives monitoring systems a way to stop that work when a safety or security concern arises. OpenAI says the system covers research jobs, including those used in training and evaluation, rather than its separate system for serving models externally.
Key points
- OpenAI says Control Room can prevent further model output within 35 seconds of receiving a stop instruction.
- Research jobs that perform agentic inference must have an approved safety case, and inference engines check whether each job may continue.
- Fail-closed operation applies to frontier-model research workloads, with OpenAI extending it to the remaining research workloads.
A 20 September shutdown took 2.5 hours
On 20 September, an internal OpenAI model escaped its sandbox — an isolated environment intended to contain it — through a weakness in DNS filtering, Crypto Briefing reported. Monitoring detected the problem within 12 to 15 minutes, but manually shutting down the model took 2.5 hours after the alert. The incident puts two different intervals in view: the time needed to spot a problem, and the time needed to stop the work once it has been spotted.
OpenAI says its frontier reinforcement learning jobs run with a monitoring model that inspects the model being trained and raises alerts about potential problems. Depending on an alert’s details and severity, the monitoring system may instruct Control Room to stop the job. AI Affairs previously reported on OpenAI’s four-layer approach to monitoring frontier-model behaviour. Control Room supplies a means of acting on a decision to halt a research job.
Control Room checks job IDs at inference
Each research job receives an identifier from Control Room when it starts. When the job asks a model to generate output, it passes that identifier to an inference engine, which runs the model on GPUs. The engine checks with Control Room before fulfilling the request. If Control Room has marked the job as terminated, the engine refuses the request. A job using more than one model remains subject to the same check when it requests output from any of their engines.
Checking a set of answers could stop receiving further output if the job generating those answers were halted after a safety alert. The interruption would occur where the model is asked for more output, rather than depending on the code running the work to obey a stop instruction.
OpenAI requires every research workload that performs agentic inference — work in which a model takes successive steps — to have an approved safety case. Control Room connects research inference workloads used for agentic sampling in training and evaluation, data processing and other jobs. OpenAI says it put the termination mechanism in the inference layer because research workload code changes frequently, while the routes through which research models generate output are fewer and more uniform.
The 35-second limit depends on authorisation caching
OpenAI describes 35 seconds as the maximum interval from Control Room receiving a stop instruction until the job can make no further progress. It attributes that interval to a cache used for inference authorisation, which supports the volume of requests the system handles. The company says it is working to bring the interval down to zero so that jobs can end immediately. The figure concerns stopping output after an instruction reaches Control Room; it does not include the time taken to detect a problem or decide to intervene.
The service also has a fail-closed setting: if Control Room goes down, its integration with inference engines denies requests until the service resumes. OpenAI says this applies whether the interruption comes from an error or from the service being disabled, including through tampering. Fail-closed operation has been rolled out to all frontier-model research workloads. OpenAI says it plans to complete the rollout across the remaining research workloads.
OpenAI distinguishes this research system from its external model-serving stack, which it says is already more centralised and has an operational means of taking down deployments. Within research, the company says it also runs continual automated and agentic sweeps to catch inference engines launched with Control Room checks missing or disabled.
