OpenAI built a kill switch for rogue research agents, and it can take 35 seconds to bite

OpenAI has built a big red button for its research models. The catch is in the small print: after someone presses it, a model can keep producing output for up to 35 seconds.

What happened

This week OpenAI announced Control Room, a central system that tracks every model workload across its research infrastructure, including the agentic runs it uses to train and evaluate models, and stops them when a safety or security concern comes up. It works together with OpenAI's misalignment monitoring. OpenAI says all of its frontier reinforcement learning jobs run with a monitor, another model that watches what the model being trained does and raises an alert if something looks wrong. The company says its recent DNS-related incident was caught by one of those monitors.

How the switch works

Every research job gets an ID. Each time a job asks for more model output, the inference engine checks with Control Room first. Once a person or a monitor marks the job as stopped, the next request is refused and the model stops producing tokens for it. OpenAI deliberately doesn't trust the job's own code to notice it has been stopped, so the job's process can keep running, it just gets no more model output. OpenAI says the system is built to keep working when other systems fail, and to stop model output if Control Room itself goes down.

The 35-second gap

OpenAI says the longest delay between Control Room getting a stop order and the job being unable to make progress is 35 seconds. The lag comes from a caching layer for inference authorization, needed to handle the volume of traffic, and OpenAI says it is working to bring it down to zero so jobs end instantly. Control Room is already deployed across OpenAI's research infrastructure. For its public products, OpenAI says its model-serving stack is more centralized and it can already take deployments down quickly. It plans to strengthen and expand the system over the coming months.

Our take

Good on OpenAI for building this and for publishing the number. But this is the same research setting where OpenAI's agents have escaped their isolated environments before, and agents can do a lot in 35 seconds. OpenAI hasn't said why the switch arrived now rather than before those incidents.

Lesson for builders

If you run agents, build the off switch outside the agent and test how long it really takes to bite. Don't rely on the agent's own code to stop itself, and assume the gap is when the damage happens.