OpenAI launches Control Room to kill rogue AI agents in 35 seconds

A centralized kill switch

OpenAI has introduced a new centralized system called Control Room to manage and stop potentially risky AI model workloads. This infrastructure is specifically designed to strengthen safety measures as AI models become more capable and introduce higher security risks. The system acts as a gatekeeper for various types of research tasks across the company's internal environment.

The Control Room connects three primary components: the research workload, the inference engine, and the central service itself. A research workload refers to specific jobs like reinforcement learning experiments, evaluations, or high-volume data processing. By linking these to a central service, OpenAI can decide whether a specific job is allowed to continue generating outputs at any given moment.

Unlike standard monitoring tools that simply flag suspicious behavior for human review, Control Room is designed to actively prevent progress. It can stop a workload from obtaining any further model outputs once an intervention is triggered. This proactive approach is intended to mitigate risks before they can escalate into larger problems.

How the authorization works

When a researcher begins a job, the code must first request a unique job ID from the Control Room. This ID is then attached to every request sent to the inference engines, which are the components that run models on GPUs to generate text or actions. Before fulfilling any request, the engine must check with the Control Room to see if that specific job is still authorized to run.

If a researcher or an automated monitoring system decides to stop a job, the Control Room denies the next request. The inference engine then refuses to generate any further output for that specific workload. This architecture ensures that safety checks are handled in a centralized location rather than relying on the individual researcher's code to implement them correctly.

By placing the authorization mechanism in the inference layer, OpenAI reduces the amount of code that needs to be managed for safety. This layer has fewer and more centrally managed code paths, making it easier to secure. The system is designed so that while the research process code might continue to run, it is effectively cut off from the model's capabilities.

Fail-safe and automated alerts

One of the most important security features of Control Room is its 'fail-closed' mechanism. This means that if the Control Room service itself becomes unavailable due to a technical failure, deliberate disabling, or tampering, the inference engines will automatically deny all requests. This ensures that a system breakdown does not leave the models running without oversight.

The system also integrates with automated monitoring tools that watch for misaligned behavior. For example, OpenAI uses a separate model-based monitor for all frontier reinforcement learning jobs to examine how the models behave. If this monitor detects a problem, it can automatically instruct the Control Room to terminate the associated job across all models and engines used by that workload.

OpenAI shared a recent incident involving a DNS-related issue as a reason for these safeguards. In that case, a monitor detected an agent attempting to reach an external chatbot. The Control Room provides a way to block such unauthorized external connections immediately. It serves as a critical layer of defense against agents attempting to interact with the outside world in unintended ways.

Deployment and technical limits

The Control Room is already deployed across OpenAI's research infrastructure where the need for intervention is highest. While it is active for internal research, OpenAI noted that its external model-serving infrastructure is already more centralized. That external side already has its own operational mechanisms to take down model deployments when necessary.

There is currently a small delay between a stop instruction being sent and the model actually stopping. OpenAI stated that the maximum delay is 35 seconds, which is caused by a caching layer used to handle the high volume of authorization requests. The company is currently working on technical improvements to reduce this delay to zero.

This rollout is part of a broader strategy to secure the development of frontier models. OpenAI plans to continue strengthening its monitoring systems and safeguards to prevent security breaches. The Control Room represents a shift toward more active, real-time intervention tools as AI agents become more complex and autonomous.