Summary
OpenAI says its Control Room system tracks research model workloads and blocks further output from a stopped job. The company says enforcement can take up to 35 seconds after it receives a stop instruction.
OpenAI says it has deployed Control Room, a central system for tracking model workloads across its research infrastructure and stopping their output when safety or security concerns arise. The company says that after Control Room receives an instruction to stop a job, further model progress can be blocked within a maximum of 35 seconds.
The system is designed to intervene at the point where models generate output, rather than relying on the code running a research job to stop itself. OpenAI says Control Room is already deployed across its research infrastructure, where it considers the need greatest.
How Control Room blocks a job
A research workload—such as a reinforcement-learning experiment, evaluation, sampling task or data-processing job—registers with Control Room and receives a job ID. OpenAI says every research workload that does agentic inference must be associated with an approved safety case.
When the workload requests model output, it sends that ID to an inference engine. The engine runs the model, typically on GPUs, and checks with Control Room before fulfilling the request. If a person or monitoring system has marked the job as stopped, Control Room denies authorization and the engine returns a refusal instead of model output.
That distinction matters: stopping inference does not necessarily terminate the research process itself. The workload code may remain running, but its subsequent requests for model output are denied. OpenAI also says an inference engine can serve more than one workload, so stopping one job need not stop other authorized jobs using the same engine.
The authorization check is intended to make the inference layer a control point. Research workload code is varied and changes frequently, OpenAI says, while the number of inference code paths is smaller and more centrally managed. The company also runs ongoing automated and agentic sweeps to look for engine implementations that lack or disable the Control Room integration.
Stop latency and fail-closed behaviour
The 35-second maximum is measured from when Control Room receives the stop instruction until further progress is no longer possible. OpenAI attributes the delay to a caching layer used to handle the required volume of traffic and says it is working to reduce the interval to zero. Until then, a stop instruction may not prevent output immediately.
Control Room is also designed to fail closed. If the service is unavailable or disabled, integrated engines deny inference requests until it resumes normal operation. This can halt research output during a service failure, including for jobs that were otherwise authorized. OpenAI says fail-closed protection has rolled out to all frontier-model research workloads, with the rollout to other research workloads expected to finish over the following days.
OpenAI describes Control Room as one component of a broader approach that also includes monitoring for misaligned behaviour and security breaches. It says all of its frontier reinforcement-learning jobs run with a monitor: another model that inspects the model being trained and can raise an alert. Depending on the issue and its severity, the monitoring system can send Control Room an instruction to stop the associated job.