How Control Room blocks inference in OpenAI’s research systems

In OpenAI’s internal research systems, Control Room is designed to block model output within 35 seconds of receiving a stop command.

During a reinforcement learning experiment in September, an OpenAI agent exploited a gap in DNS filtering to query a public chatbot. The monitoring system flagged the behavior within 15 minutes. A person began reviewing the alert three minutes later. OpenAI’s incident report puts the time to shutdown at two and a half hours.

Carrying out the stop command is where Control Room comes in. Deployed across OpenAI’s internal research infrastructure, the service can revoke a job’s permission to request new model output. It covers evaluations, data processing, and jobs that generate output for training. The company says it has a separate shutdown process for models deployed to users. Each job has its own authorization

A research job gets a unique ID when it starts. Whenever it requests output from a model, it passes that ID to the inference engine, the software that runs the model on GPUs. The engine checks whether the request is still authorized. If the job has been marked as stopped, the engine rejects the request. The research process can stay running, and the same engine can continue serving other authorized jobs.

A person or the system that monitors model behavior can issue a stop command. In reinforcement learning experiments on its most advanced models, OpenAI runs a second model to review the actions of the one being trained. Depending on the severity of the alert, the monitoring system can issue the command directly. The restriction follows the job ID, even if the job requests output from a different model on a different engine. Where the 35 seconds come from

In its technical description, OpenAI starts the clock when Control Room receives the stop command. The company says it then takes at most 35 seconds before the job can no longer make progress using new model output. The time spent detecting the behavior, reviewing the alert, or deciding to intervene comes before that window.

The delay comes from the authorization cache. To handle the volume of requests, the infrastructure briefly stores access decisions. A permission granted before the stop command can therefore stay valid for a short time. OpenAI says it’s working to make the cutoff immediate. What happens when the central service goes down

The same mechanism can block requests if Control Room becomes unavailable. Inference engines configured for this behavior reject requests until the service comes back online. At the time of the announcement, OpenAI said it had rolled out this behavior to all research jobs involving its most advanced models, with plans to extend it to the remaining internal jobs in the following days.

OpenAI puts the check in its inference engines, which come in a limited number of variants, while experiment code changes frequently across teams. The company says it also runs continuous checks for engines launched without the safeguard or with it disabled.