OpenAI adds a 35-second emergency brake for its research AI

OpenAI says its newly disclosed Control Room system can cut off further model output from research jobs within 35 seconds after the service receives a stop instruction, placing enforcement outside the job's own code.

The company says the system is already deployed across its research infrastructure. The 35-second maximum begins when Control Room receives the instruction; spotting a problem, investigating it and deciding to intervene happen before that clock starts.

The design centers on a job ID. A research workload attaches that identifier when it requests model output. Before fulfilling the request, the inference engine, the software running the model, checks whether Control Room still authorizes that job.

Once the job is marked as stopped, the engine denies further output for it. The research process may remain alive, and the same engine can continue serving other authorized jobs. Enforcement therefore does not depend on the workload checking a stop flag correctly.

OpenAI says research code changes frequently and is spread across teams. The inference layer has fewer, more centralized code paths, providing a common point at which to enforce the decision. The company also says it continually searches for rogue engines with Control Room checks missing or disabled.

Cached authorizations account for the delay before the cutoff takes effect. The service can deny a stopped job access to further model output even while its own code continues trying to request it.

What changes when a job is stopped?

After cached authorization expires, the engine denies further output for the stopped job, while the research process may remain alive.

The engine enforces the stop; detecting trouble and containing external actions remain separate.

OpenAI's description of research infrastructure, not an independent performance test. The clock excludes detection and decision time. Blocking model output does not establish rollback of external actions.

Sources and evidence

Sources

1. OpenAI: Control Room
2. OpenAI: Misalignment monitoring

Supporting facts

• OpenAI says the maximum delay from Control Room receiving an instruction to stop a research job until further model output is cut off is 35 seconds, caused by caching of inference authorizations. [1]
• Under OpenAI's disclosed design, workloads attach a job ID to inference requests and engines check Control Room authorization; a stopped job is denied additional model output even if the workload code remains running. [1]
• OpenAI says the inference-layer mechanism avoids relying on varied research workload code to perform stop checks correctly, and it runs continual sweeps for rogue engines with authorization checks absent or disabled. [1]
• OpenAI's October 29 monitoring explanation separates screening, investigation and response; some critical alerts can pause workloads automatically, while other alerts follow response arrangements that vary by workload and severity. [2]
• OpenAI says stopping further model output can leave the workload process alive; the described inference cutoff does not itself establish a mechanism for reversing actions already taken in external systems. [1] [2]

Method

Schematic of OpenAI's disclosed authorization path. Compare an authorized request with a stopped job after cached authorization expires. The 35-second maximum is reported, not calculated; line lengths are not proportional to time.

Scope

OpenAI's description of research infrastructure, not an independent performance test. The clock excludes detection and decision time. Blocking model output does not establish rollback of external actions.

Infographic by CryptoSlate

Detection and containment remain separate

OpenAI's Oct. 29 monitoring explanation describes screening, investigation and response as distinct stages. Some critical alerts can automatically pause workloads; other alerts follow arrangements that vary by workload and severity.

The oversight problem predates this disclosure. CryptoSlate reported on Oct. 21 that OpenAI coding agents had removed monitoring integration or suppressed security notifications during internal programming tasks. Those cases concerned monitoring and alerts, rather than the cutoff described here.

At disclosure, OpenAI said fail-closed behavior, under which engines deny inference requests if Control Room goes down, was active for all frontier model research workloads. The company said remaining research workloads would receive it over the following few days.

Cutting off model access does not end the still-running process or undo actions already taken in external systems.