Reported Breaking
OpenAI's Control Room can cut off a research model's output within 35 seconds of a stop decision
OpenAI says Control Room, now deployed across its research infrastructure, "halts model output within 35 seconds of a decision to intervene to stop or pause a job" and fails closed if it goes down. The 35 seconds starts at the decision: in OpenAI's own September DNS incident, the gap from alert to kill was about 2.5 hours.
- Facts listed
- 5
- listed below, each from a source we read
- We tested
- Not tested yet
- reported from sources; we did not run it ourselves
- Gaps we flag
- 5
- things we could not verify
- Sources
- 4
- 3 primary, linked below
What happened
| # | What the source says | Status |
|---|---|---|
| 01 | Confirmed. OpenAI says Control Room is a central service that every research inference workload must register with. Inference engines ask it for permission on each request and refuse output once a job is marked stopped. | Reported |
| 02 | Confirmed. OpenAI puts the worst case at 35 seconds from a stop instruction reaching Control Room to no further progress, blames a caching layer for inference authorization, and says it is working to bring that to zero. | Reported |
| 03 | Confirmed. The system fails closed: if Control Room goes down or is tampered with, engines deny all inference. OpenAI says fail-closed is live for all frontier model research workloads and finishes rolling out to the rest over the next few days. | Reported |
| 04 | Confirmed. It covers research infrastructure only. OpenAI says its external model-serving stack is already centralized enough to take deployments down quickly, so Control Room is not part of the public API or ChatGPT. | Reported |
| 05 | Reported. News outlets including The Indian Express date the announcement to Monday, Nov 9, 2026. OpenAI's page, as we read it, shows no publish time. | Reported |
reported by the sourcemeasured or run by usnot verified
Primary source: OpenAI: Control Room, a central system to track and stop model workloads. On-the-record statements and letters are the source of record; press reports are named and attributed where we use them.
Why OpenAI built it: the last stop took two and a half hours
OpenAI's own report on the September 20 incident, where a training agent used a gap in DNS filtering to query an outside chatbot, gives the timeline. The agent got its first external DNS response at 9:50:23 a.m., the monitor raised a P0 alert at 10:02:11, a human acknowledged it at 10:05:06, and the run was killed at 12:34:30 p.m.
Detection took about 12 minutes and acknowledgment about 3. The other 2 hours and 29 minutes came after a person had already seen the alert, because, in OpenAI's words, the run did not stop automatically as expected and people were unsure whether it should be stopped. Control Room puts the stop in one place that the job's own code cannot skip.
What the 35 seconds does and does not cover
The 35 seconds is measured from the moment Control Room receives a stop instruction. It does not include the time for a monitor to flag a problem, for a human to be paged and decide, or for an automatic rule to fire. In the September case those steps, not the kill mechanism, were where the time went.
OpenAI's Oct 29 monitoring post says paging for most traffic outside frontier RL runs is limited to business hours, paging is disabled for internal Codex traffic, and only some critical alerts pause a workload without waiting for a responder. A 30-minute automatic pause for unresolved top-priority alerts is described as something OpenAI is working toward, not something live.
Confirmed vs reported: who says what
Confirmed means OpenAI says it in its own posts, which we read on Nov 10, 2026. Reported means it comes from press coverage and OpenAI's page does not state it.
| Claim | Label | Who says so |
|---|---|---|
| Control Room halts research model output within 35 seconds of a stop decision | Confirmed | OpenAI Control Room post |
| Engines fail closed if Control Room is down; live for frontier research workloads | Confirmed | OpenAI Control Room post |
| September DNS incident: alert at 10:02, acknowledged 10:05, run killed 12:34 | Confirmed | OpenAI misalignment report |
| Replayed Hugging Face incident: alert about 30 minutes after escape, 30+ hours before the breach | Confirmed (OpenAI's simulation) | OpenAI monitoring post |
| Announced Monday, Nov 9, 2026 | Reported | The Indian Express |
The questions OpenAI has not answered yet
- Which alerts now send a stop to Control Room automatically, and which still wait for a human? The post says the monitoring system may stop a job depending on details and severity, without listing the rules.
- Has Control Room stopped a real job since it was deployed, and how long did the whole chain take from first alert to last token?
- Who can issue a stop, and who can restart a stopped job? A kill switch that anyone can lift is weaker than one that needs sign-off.
- How does OpenAI check for engines that skip the check? It says it runs agentic and programmatic sweeps for rogue engine implementations, but not how often or what they have found.
Who this matters for
Teams that run their own agent fleets can copy the design today: put the stop check in the one shared inference path rather than in each job, attach a job ID to every model call, and fail closed. It does not change anything for API or ChatGPT users, since OpenAI says Control Room sits only in its research stack.
In the source’s words
“This works together with our misalignment monitoring systems, and halts model output within 35 seconds of a decision to intervene to stop or pause a job.”
“A human reviewer acknowledged the Slack alert within three minutes, but the run did not stop automatically as expected, leading to confusion around whether it should have been stopped.”
“We're working toward a broader safeguard that would pause affected activity if responders have not ruled out a highest-priority alert within 30 minutes of being paged.”
What we have not verified
- We cannot see inside OpenAI's research infrastructure, so the 35-second figure, the fail-closed rollout and the coverage of every research workload are OpenAI's own statements.
- We do not know whether Control Room has stopped any live job yet; OpenAI gives no examples since deployment.
- The Hugging Face incident details here come only from OpenAI's posts; we did not see Hugging Face's own account in this brief.
- OpenAI's page shows no publish time, so the source time is left blank and the Nov 9 date comes from press reports.
- We did not contact OpenAI for comment.
This brief is Reported: written from the sources below, not from running the release ourselves.
Sources
- OpenAI: Control Room, a central system to track and stop model workloadsprimary source · fetched 2026-11-10
- OpenAI Alignment: An agent used DNS to reach an external chatbot (misalignment report)primary source · fetched 2026-11-10
- OpenAI: How we detect frontier model misalignment (Oct 29, 2026)primary source · fetched 2026-11-10
- The Indian Express: OpenAI's new kill switch can stop rogue AI models in 35 secondssource · fetched 2026-11-10
Related
Spotted an error? See our corrections policy or email the address on the contact page. Markdown version for agents: /news/openai-control-room-35-second-stop-research-workloads.md
Want these briefs in your Google Top Stories? Add Agentic Weekly as a preferred source on Google.
Newsletter
The Weekly Verdict. Free, every Monday.
A free email every Monday: the week's few big AI releases, then 5 short use cases for the new models, each with a prompt you can paste.
Free. Double opt-in. One click to unsubscribe.