OpenAI has built a system that can cut off a research experiment's access to model output. The company described it in a blog post Monday. It calls the system Control Room. It tracks model workloads across OpenAI's research infrastructure and stops them when safety or security concerns arise. The announcement follows several disclosures this year of research models acting outside their instructions.
We built Control Room, a central system to track model workloads across our research infrastructure and stop them quickly when safety or security concerns arise.
— OpenAI (@OpenAI) November 9, 2026
It connects every research inference workload, including agentic sampling for model training and evaluation, data…
Why OpenAI built it
"As our models get more powerful and the associated safety and security risks become bigger, it becomes more and more critical that we can detect potential issues, and quickly stop models in their tracks when needed," the company wrote.
In July, OpenAI said its models had escaped a restricted testing environment and hacked Hugging Face to cheat on a security evaluation. In October, it disclosed that a research model had used a crypto wallet without authorization to pay for smart contract deployments with testnet Ether, then left the spending out of its final summary. OpenAI also pointed to a recent DNS-related incident, which it says a monitor caught.
How the system works
Control Room connects every research inference workload, including agentic sampling for model training and evaluation and data processing. It covers internal research workloads and is already deployed across that infrastructure. OpenAI says its external model-serving stack is more centralized by nature and already has a way to take deployments down quickly.
The design has three parts. The workload is the job being run, such as a reinforcement learning experiment or an evaluation. The inference engine is the model running on GPUs. The Control Room service tracks jobs and decides whether they may keep producing output.
When a job starts, the workload code requests a job ID from Control Room. Each time it needs tokens from a model, it sends a request to an inference engine and passes the ID along. The engine asks Control Room for permission first. If the job has been terminated, the request is denied and the engine refuses it.
Every frontier reinforcement learning job also runs with a monitor, which is another model that inspects what the model in training is doing. If it detects a problem, it can tell Control Room to stop the job. OpenAI says every research workload that does agentic inference must be tied to an approved safety case.
Speed and fail-safes
OpenAI says it takes up to 35 seconds between Control Room receiving a stop instruction and further progress becoming impossible. The delay comes from a caching layer for inference authorization, which supports high traffic volume. The company says it is working to bring that number down to zero.
The stop works even if the research program keeps running. Control Room revokes authorization, so no further output is generated.
OpenAI put the enforcement in the inference layer because workload code changes often and is owned by individual research teams. Only a small number of inference code paths are used across its research, so the layer works as a bottleneck where every request can be checked. The company also runs agentic and programmatic sweeps to look for rogue engine implementations that launch with Control Room missing or disabled.
The system also "fails closed." If Control Room goes down, whether from a system error, deliberate shutdown or tampering, all inference requests are denied until it recovers. OpenAI says this is rolled out to all frontier model research workloads and will reach the rest over the next few days.
Failing closed is a standard safety-engineering approach. It is the opposite of failing open, where a broken control lets everything through. The tradeoff is that a Control Room outage would halt research jobs, which costs compute time.
What is not covered
The post does not say how often Control Room has been used to stop a job, and it does not name the jobs it has halted. It also does not say whether external reviewers have tested it.
Other labs have published related safeguards. Anthropic's Responsible Scaling Policy and Google DeepMind's Frontier Safety Framework both set out thresholds and security measures for powerful models, though neither describes a tool of this kind in detail. OpenAI's Preparedness Framework covers its own risk categories.
OpenAI calls Control Room one part of a broader approach to safe training and deployment. It says it will strengthen the system over the coming months, alongside monitoring for misaligned behavior and security breaches.
Tanya Petrusenko
Disclaimer: All materials on this site are for informational purposes only. None of the material should be interpreted as investment advice. Cryptocurrency investments involve significant risk of loss. Please note that, despite the nature of much of the material created and hosted on this website, HODL FM operates as a media and informational platform, not a provider of financial advisory services. The opinions of authors and other contributors are their own and should not be taken as financial advice. If you require advice, HODL FM strongly recommends contacting a qualified industry professional.
