Control Room: A central system to track and stop model workloads across our research infrastructure

OpenAI says Control Room now tracks every research inference workload, including agentic sampling for training and evaluation, and can halt model output within 35 seconds of a decision to stop a job. Every research workload that does agentic inference must be tied to an approved safety case. The system is wired into OpenAI's misalignment monitors, which watch all frontier reinforcement learning jobs and can trigger a stop on their own.

This matters because the riskiest models a lab runs are often not the ones the public uses. They're experimental systems inside training and evaluation loops. OpenAI says its external serving stack already has strong takedown capability; Control Room extends that to research, where it says the need is greatest.

We think this is a genuinely good piece of safety engineering, and we want to give credit where it's due. The smart move is where the check lives. Instead of trusting researcher-written job code to stop itself, OpenAI puts the gate in the inference engine. There are only a few inference code paths across research, so enforcing a permission check on every request there gives far stronger guarantees than policing thousands of fast-changing experiments.

The fail-closed design is the second big win. If Control Room goes down, by error or by tampering, all inference requests are denied until it comes back. That trades availability for safety, which is the right trade for frontier research. OpenAI says fail-closed is live for all frontier model research workloads and will reach the rest of research over the next few days. OpenAI also says it runs continual sweeps for rogue engines that skip the check.

Now the honest limits. Thirty-five seconds is a long time for a fast agent with tool access. OpenAI says the delay comes from an authorization cache and that it's working toward zero, which is the right goal. We'd also note that stopping output isn't the same as undoing actions already taken during those seconds, or before anyone noticed. A kill switch is only as good as the monitor that pulls it, and the post doesn't share false negative rates or how often monitors fire.

There's a verification question too. This is a self-described system. We have no independent audit, and outsiders can't confirm coverage claims. The post references a recent DNS-related incident caught by a monitor, which shows the monitoring layer is doing real work, but it also confirms that things do go wrong in these environments.

Where this leads is encouraging if others follow. Lawmakers are now openly discussing kill switch requirements. A concrete, inference-layer, fail-closed design is the kind of reference architecture that could make such a requirement workable rather than symbolic. I'd like to see OpenAI publish enough detail, and invite enough outside review, that this becomes an industry baseline rather than a company blog post.

Control Room links three parts: the workload, which requests a job ID tied to a safety case; the inference engine, which asks Control Room for permission before every request; and the Control Room service, which denies requests for stopped jobs. A stopped job's code can keep running, but it can no longer get model output, while the engine stays available to other authorized jobs.