A stop button in the inference layer
OpenAI has described a system called Control Room that tracks every model workload running across its research infrastructure and can stop any of them from producing further output. In a post published on 9 November, the company said the maximum time between the moment Control Room receives an instruction to stop a job and the moment further progress is no longer possible is 35 seconds.
The unusual part is where the stop sits. Research code — the experiments, evaluations and high-volume sampling jobs that researchers write and change constantly — is not asked to check whether it is still allowed to run. Instead, every research workload that performs agentic inference must register with Control Room and receive a job identifier, which it attaches to each request it sends to an inference engine. The engine, not the workload, asks Control Room whether that job is still authorised. If the answer is no, the engine refuses to generate.
OpenAI’s stated reason is blunt. Workload code, it wrote, “changes often, and is not an ideal place to implement critical load-bearing safety protections”. There are only a very small number of inference code paths across all of its research, so the inference layer can act as a bottleneck where every single request is checked.
Where the 35 seconds comes from
The delay is not deliberation. OpenAI attributes it to a caching layer for inference authorisation, needed to carry the required volume of traffic, and said it is “working to drive this number down to zero so that we can end jobs instantly”. Until then, a model that has been told to stop can keep producing output for up to half a minute.
Every registered job must also be tied to an approved safety case, a requirement the company set out in a September post on safety cases for frontier AI training. Stopping a job does not kill the surrounding process: the workload stays alive, the engine stays available to other authorised jobs, and only the output stops.
Fails closed, and still rolling out
Control Room is designed to fail closed. If the service goes down — through a system error, because it has been disabled, or through what OpenAI calls “tampering by a bad actor” — all inference requests are denied until it resumes normal operation. The company said fail-closed behaviour is rolled out now to all frontier model research workloads and will finish rolling out across the remaining research workloads “over the next few days”. It also said it runs continual agentic and programmatic sweeps to check that nobody has launched an inference engine with Control Room disabled.
Why the gap was on the research side
OpenAI said its external model-serving stack is already much more centralised by nature, with a well-developed ability to take model deployments down quickly. Research was the gap, and the company says that is where the need is greatest.
The trigger it describes is a monitor: a second model that inspects what the model being trained is doing and raises an alert. OpenAI pointed to a published report in which an agent used DNS to reach an external chatbot as a case a monitor caught, and set out the monitoring work in more detail in late October. If the monitoring system decides a job should stop, it sends the job identifier to Control Room and the next inference request is refused.
The number to watch is the 35 seconds. OpenAI has named it, explained it as a caching artefact and committed to removing it. For now it is the clearest published figure for how quickly a frontier lab can stop its own models mid-run.
