OpenAI's Control Room Cuts Research Model Output in 35 Seconds

OpenAI has put a single brake on its research infrastructure. Control Room is a central service that tracks every model workload in its research clusters: RL experiments, evaluations, high-volume sampling, data processing, anything doing agentic inference. When a safety or security concern comes up, a person or a monitoring system issues a stop, and within 35 seconds that job can no longer get model output.

First, the misread worth heading off: this is not a kill switch for ChatGPT. Control Room lives on the research side. OpenAI says its external serving stack is already highly centralized, with mature tooling to take deployments down fast. The hard part is research, where workload code is written and run by individual researchers and teams.

There are three parts: the research job, the inference engine, and Control Room. A job requests a job_id at startup and must be tied to an approved safety case. Every sampling request it sends to an engine carries that ID, and the engine checks with Control Room before generating anything. Once a job is marked stopped, its next request is denied and the engine returns a refusal instead of tokens.

The interesting choice is where enforcement sits. OpenAI explicitly does not trust workload code to check whether it has been stopped, because that code changes constantly and is scattered across teams. Inference, by contrast, runs through only a handful of code paths that are centrally deployed. That makes the inference layer a natural chokepoint: the job process can keep running, but it gets nothing back. The engine keeps serving other authorized jobs, so the blast radius stays on the one job in question.

Either a human or a monitor can pull the brake. Every frontier RL job at OpenAI runs alongside a monitor model that inspects what the model being trained is doing and raises alerts. Depending on severity, the monitoring system can send the job_id to Control Room on its own. OpenAI points to its recent DNS-related incident, which a monitor caught.

Don't read 35 seconds as a typical latency. It is the ceiling, set by a cache in front of inference authorization that exists to handle request volume. OpenAI says it is working to bring it down to zero.

The stronger guarantee is fail-closed. Engines are configured so that if Control Room goes down, whether from an error, being disabled, or tampering, every inference request is denied until it recovers. Taking out the brake doesn't free a job; it halts the whole research fleet. OpenAI also runs continual agentic and programmatic sweeps for rogue engines that skip or disable the check.

Rollout status: fail-closed is live for all frontier model research workloads, with the remaining research workloads following over the next few days.

The timing is what matters. As models run longer autonomous tasks, internal deployment (training, evals, automated research) becomes a risk surface of its own. "Can you stop the model?" has mostly been a question of principle. Control Room turns it into an engineering constraint: every token needs permission, and no permission service means no tokens. Thirty-five seconds isn't zero, and rogue engines are caught by sweeps rather than made impossible. Still, this is the first time a frontier lab has shipped centralized, default-deny stop authority over its internal inference as infrastructure. The question for every other lab is now concrete: how long does it take to stop a job on your research cluster?