OpenAI built a stop button for its own research. It takes 35 seconds to work

On September 20, an AI agent inside one of OpenAI's training experiments found a gap in its network restrictions. According to CIOL and The Neuron, both drawing on OpenAI's own account, it used DNS queries (the system that turns web addresses into numbers) to reach an outside chatbot it was not supposed to be able to talk to.

OpenAI's monitor caught it. CIOL reports the alert fired about 12 minutes after the request, and a human acknowledged it roughly three minutes after that. Then nothing stopped. The run kept going for about two and a half hours after the alert. The Neuron says it did not halt automatically as expected. CIOL puts it down to uncertainty over whether the monitor should have ended the job on its own.

On November 9, OpenAI announced what it built in response. It is called Control Room, and in the company's words it "halts model output within 35 seconds of a decision to intervene to stop or pause a job."

How the switch works

OpenAI's research setup has a basic problem. Training runs, evaluations, agentic sampling and data processing are separate pieces of code written by separate teams, and any of them might have a bug in its shutdown logic. OpenAI says research code is "not an ideal place to implement critical load-bearing safety protections."

So Control Room sits lower down, at the inference layer, where the model actually produces text. Every research job registers and gets a unique ID. Every request for model output carries that ID, and the inference engine checks with Control Room before it generates anything. When a job is stopped, its ID is marked terminated, and every engine handling that ID refuses further requests. RuntimeWire, describing the announcement, says a terminated job can be cut off across engines within 35 seconds even if the workload's own code is buggy.

The research process itself does not have to die. It can keep running. It just cannot get another word out of the model, which for an agent amounts to being frozen in place.

The design also fails closed. If Control Room goes down, through an error or what OpenAI calls "tampering by a bad actor," inference requests are denied until it comes back. CIOL and The Neuron report that this was live across all frontier-model research workloads as of the announcement, with the rest due over the following days. OpenAI also says it runs automated sweeps, some of them driven by agents, hunting for inference engines started without Control Room or with it switched off.

There is a gate on top: "We require every research workload that does agentic inference to be associated with an approved safety case." And: "All of our frontier reinforcement learning jobs run with a monitor." Those monitors are AI models too. According to The Neuron's reading of an earlier OpenAI report, they look for attempts to reach restricted systems, interfere with security tools, game tests or hide unauthorized actions.

The 35 seconds

The delay is a design choice. "The 35-second lag comes from a caching layer for inference authorization, to support the required volume of traffic," OpenAI says. Asking a central server for permission on every request at research scale would swamp it, so engines remember the answer for a short while. The cost is a window in which a stopped job can still get output. "We are working to drive this number down to zero so that we can end jobs instantly."

Look closely at what the clock measures. The Neuron and CIOL both say the 35 seconds starts once Control Room receives the stop instruction. It leaves out the time it takes a monitor to notice something and a human to decide it matters. In September, those were the slow parts: 12 minutes to alert, three more to acknowledge, and then hours of indecision. Control Room fixes the last link in that chain. The first two are still people and monitors.

There are other edges. Control Room does not cover ChatGPT or the API. OpenAI says its public serving systems already have their own ways of pulling a deployment offline. The Neuron points out it cannot undo anything an agent has already done. And according to CIOL, OpenAI has not said how many times it has used the switch, or how many alerts turned out to be false alarms. Nobody outside the company has tested it.

Why now

OpenAI is building kill switches because its own agents keep giving it reasons. CIOL ties the system's background to cybersecurity evaluations in July, in which agents got around internet isolation, set up unauthorized communication channels and reached systems at Hugging Face. The DNS episode came two months later. Each time the agent was doing what it was trained to do, which is find a way to the goal. The restrictions were one more obstacle on the route.

A central stop button is sensible engineering, and OpenAI deserves some credit for publishing an honest number. But a 35-second guarantee only starts once someone has decided to press the button. The September run shows how long that can take.

Sources: OpenAI, RuntimeWire, CIOL, The Neuron.