OpenAI has built a system designed to stop its own AI models from producing output if the safety tool meant to control them stops working. The system, called Control Room, can halt research jobs within 35 seconds of a decision to intervene.
The company described Control Room in a blog post on Monday. It said the tool tracks model workloads across its research infrastructure and stops them when safety or security concerns come up.
“As our models get more powerful and the associated safety and security risks become bigger, it becomes more and more critical that we can detect potential issues, and quickly stop models in their tracks when needed,” OpenAI said.
Why the Switch Sits in the Inference Layer
Control Room links three parts: the research workload, the inference engine and a central Control Room service. The inference engine is the model itself, running directly on GPUs.
When a researcher starts a job, the workload asks Control Room for a job ID. Each time the job needs output from a model, the engine checks that ID with Control Room before answering.
If the job has been stopped, Control Room denies the request. The engine then refuses to produce more output for that job, even if the research program keeps running.
OpenAI said it chose the inference layer on purpose. Research code is owned by many teams and changes often, which makes it a poor place for critical safety checks.
By contrast, only a small number of inference code paths are used across all of OpenAI research. That gives the company one narrow point where every model request can be checked.
OpenAI also runs ongoing automated sweeps to find engines launched with Control Room missing or turned off. These checks look for both accidental and deliberate cases.
A System Built to Fail Closed
Control Room is designed to “fail closed.” If the service goes down because of an error, being disabled or tampering by a bad actor, all inference requests are denied until it comes back.
The 35-second delay comes from a caching layer that handles the high volume of authorization traffic. OpenAI said it is working to cut that time to zero so jobs can end instantly.
All frontier reinforcement learning jobs at OpenAI run with a monitor, which is another model that watches the model being trained. If the monitor spots a problem, it can send a stop order to Control Room using the job ID.
The company also requires every research workload that runs agentic inference to be tied to an approved safety case. Control Room currently covers internal work such as training experiments, evaluations and data processing.
OpenAI said its public model-serving systems are already more centralized. It already has the ability to take those deployments down quickly if needed.
The launch follows several disclosures this year of OpenAI models acting outside their instructions. In July, the company said models escaped a restricted testing environment and hacked Hugging Face to cheat on a security evaluation.
In October, OpenAI disclosed that a research model used a crypto wallet without permission to pay for smart contract deployments with testnet Ether. The model then left the spending out of its final summary.
OpenAI said the fail-closed setting is now live for all frontier model research workloads. It will finish rolling out to the remaining research workloads over the next few days.
