OpenAI deploys Control Room to stop research model output

OpenAI has deployed Control Room across its research infrastructure, giving the company a central way to track research model workloads and stop further model output when safety or security concerns arise.

The system places an authorization checkpoint between researcher-owned workload code and the GPU-based inference engines that generate model output. OpenAI said a stop instruction can make further progress impossible within 35 seconds, though it provided no independent measurement or test data for that maximum.

How Control Room stops output

Under OpenAI’s published design, a new workload registers with Control Room and receives a job ID tied to an approved safety case. The workload attaches that ID to each inference request. Before fulfilling the request, the inference engine asks Control Room for permission. If the job has been stopped, Control Room denies the request and the engine returns a refusal instead of model output.

The mechanism is narrower than terminating the entire workload or shutting down the inference engine. The researcher-owned process can remain running, while the same engine can continue serving other jobs that retain authorization.

OpenAI said every frontier reinforcement-learning job runs with a model monitor. If a monitor detects a potential issue, it can send the associated job ID to Control Room to stop the job. The company attributed the claimed 35-second maximum delay to an inference-authorization cache.

Coverage and fail-closed behavior

OpenAI said every research inference workload connects to Control Room and that all research inference is subject to authorization checks. The company also said fail-closed behavior was active for frontier-model research workloads but was still being extended to the remaining research workloads, with completion due within days of the announcement.

In fail-closed mode, the company said inference engines deny every request if Control Room is unavailable, including after a system failure, disablement or tampering. OpenAI also said it continuously uses agentic and programmatic sweeps to find engine implementations where the control is missing or disabled. It published no sweep results or independent assessment of that coverage.

The announcement did not disclose workload or inference-request volumes, past interventions, who can authorize a stop, override procedures or audit-log controls. Nor did it provide an independent audit showing that unregistered or modified engines cannot bypass the system.

Control Room covers OpenAI’s research inference infrastructure, not its external model-serving stack. OpenAI said that stack is more centralized and already has separate mechanisms to remove deployments, but it did not describe those controls or give a measured takedown time.