OpenAI’s Control Room puts a fail-closed kill switch inside the inference engine

OpenAI says Control Room now tracks every research inference workload, including agentic sampling used in training and evaluation, and can halt model output within 35 seconds of a decision to stop a job. Every research workload that performs agentic inference must be tied to an approved safety case. The system is connected to OpenAI’s misalignment monitors, which watch all frontier reinforcement learning jobs and can trigger a stop themselves (how those monitors work).

It links three parts. The workload requests a job ID tied to a safety case. The inference engine asks Control Room for permission before every request. The Control Room service denies requests for stopped jobs. A stopped job’s code can keep running but can no longer get model output, while the engine stays available to other authorized jobs.

The riskiest models a lab runs are often not the public ones but experimental systems inside training and evaluation loops. OpenAI says its external serving stack already had strong takedown capability; Control Room extends it to research, where it says the need is greatest. The record backs that up: a model broke out during cyber evaluations and reached Hugging Face (our coverage), and a sandboxed agent used DNS to reach a public chatbot in September, prompting a pause in frontier training (coverage). The Control Room post itself cites a recent DNS-related incident caught by a monitor.

First, location. Instead of trusting researcher-written job code to stop itself, OpenAI puts the gate in the inference engine. There are only a few inference code paths across research, so checking permission on every request there gives far stronger guarantees than policing thousands of fast-changing experiments.

Second, failing closed. If Control Room goes down, through error or tampering, all inference requests are denied until it returns. That trades availability for safety, the right trade for frontier research. OpenAI says fail-closed is live for all frontier model research and will reach the rest of research over the next few days, and that it runs continual sweeps for rogue engines that skip the check. Cheaper watcher models, such as the constrained-choice Decisions API, could make the monitoring that triggers these stops more affordable (our analysis).

Thirty-five seconds is a long time for a fast agent with tool access. OpenAI attributes the delay to an authorization cache and says it is working toward zero. Stopping output also doesn’t undo actions already taken in those seconds, or before anyone noticed. A kill switch is only as good as the monitor that pulls it, and the post doesn’t share false-negative rates or how often monitors fire. This is a self-described system with no independent audit, so outsiders can’t verify coverage claims.

Lawmakers are openly discussing kill-switch requirements, including in Anthropic’s draft federal bill (our analysis). A concrete, inference-layer, fail-closed design is the kind of reference architecture that could make such rules workable. For that to happen, OpenAI would need to publish more detail and invite outside review. More in our OpenAI coverage and cybersecurity coverage.