OpenAI put a stop switch beside every research workload. Test the last 35 seconds

THE SIGNAL IN ONE SENTENCE

A stop button is the least interesting part of a stop system. The interesting parts are the wire behind it, the authorization check at the other end, the clock that measures the delay and the person who knows when to pull. OpenAI published a technical description of that system on November 9. It calls the system Control Room. The company says Control Room tracks model workloads across its research infrastructure and can halt new model output within 35 seconds after receiving an instruction to stop or pause a job. That timing needs one immediate footnote. The 35 seconds do not begin when a model first does something strange. They begin when Control Room receives the decision to intervene. Detection, investigation and the human or automated decision can take longer. OpenAI's separate description of its misalignment monitoring says the highest-priority alerts typically reach human responders within 15 minutes of an initial alert when paging is enabled. Some critical alerts can pause work automatically. So there are at least two clocks. The first runs from suspicious behavior to a decision. The second runs from that decision to denied model output. A safety drill that reports only the second clock has measured the last leg of the trip, not the trip. Control Room's design is still worth understanding because it puts the enforcement point somewhere sensible. Research work at an AI lab is messy. A reinforcement-learning experiment may start and stop models, create data, launch evaluations and call tools. The workload code changes often and belongs to many teams. Asking every job to police itself would be like asking every passenger to inspect the brakes. Instead, OpenAI places the critical check at the inference layer, where the model actually produces output. When an agentic research workload starts, it registers with Control Room and receives a job ID linked to an approved safety case. Each request for model output carries that ID. Before fulfilling the request, the inference engine asks Control Room whether the job remains authorized. If the job has been stopped, the engine refuses the request. The workload can keep running. The engine can keep serving other authorized jobs. What stops is new output for the blocked job. That distinction is the whole story. OpenAI is not describing a giant red switch that powers down a data center. It is describing a permission service placed in a narrow part of the system. Each attempt to generate more output has to present its papers. This is the same reason a bank freezes one card instead of switching off every cash register. The control is selective, and it sits where the consequential action is authorized. OpenAI says the maximum 35-second delay comes from a cache used to support the required traffic volume. It is working to reduce that delay to zero. It also says the integration fails closed: if Control Room itself goes down, inference requests are denied until the service returns. Fail closed is the right instinct. It also creates an operations problem on purpose. If the authorization service fails during an ordinary research day, useful work stops. People will be tempted to add emergency bypasses, longer cache lives or convenient exceptions. Every one of those can become the route around the safety control during a real incident. The test is not whether the architecture diagram looks stern. The test is what the system does on a bad Tuesday when the network is partitioned, the cache is stale and three researchers are loudly explaining that their deadline is special. Start with the last 35 seconds. When a stop instruction arrives, record the exact time. Then measure the last authorization that was granted, the last token produced, the last model response delivered, the last tool call queued, the last external request started and the last side effect completed. Those timestamps are not interchangeable. A model can stop generating while work it already triggered continues. A queued code execution can run. A database write can commit. A message can leave the network. A credential can remain valid. Another agent can act on an earlier response. A data pipeline can preserve model output and feed it into a later stage. Control Room's public description focuses on stopping model output. It does not claim that the system automatically cancels every downstream action or reverses every external consequence. That is not a criticism of the stated mechanism. It is the boundary that operators need to mark in bright ink. The practical drill should test a whole stop chain. First, stop the model's next inference request. Then cancel queued tool actions. Revoke temporary credentials. Block outbound network paths associated with the job. Quarantine artifacts that were created after the alert. Notify the run owner and incident lead. Preserve the logs needed to reconstruct what happened. Finally, decide what must be rolled back and what cannot be rolled back. That last category matters. You can delete a generated file. You cannot make a message unseen. You can revoke a token. You cannot assume a system that used it forgot what it read. This is where the safety case should earn its name. OpenAI says every research workload that performs agentic inference must be associated with an approved safety case. In a separate September paper, the company describes safety cases as structured, evidence-based arguments about risk. It recommends monitoring, containment, clear pause procedures, audits, escalation paths and rollback ability. A useful safety case for a real workload should identify the exact models, tools, data, networks, credentials and environments the job can touch. It should name the owner, the risk level, the monitoring coverage, the conditions that trigger a pause, the people allowed to resume and the evidence required before they do. The job ID then becomes more than a technical label. It becomes a handle connecting a live process to its approved purpose and operating limits. That handle should appear everywhere the job can cause an effect. Put it on inference requests, tool calls, network egress, temporary credentials, files, database writes, alerts and audit events. If an operator stops job 042, they should be able to find the model output it created, the tools it called and the artifacts downstream systems consumed. Otherwise the stop button may halt the tap while yesterday's water keeps moving through unlabelled pipes. Control Room also avoids trusting the workload to check its own status. OpenAI says a stopped workload may continue trying to sample. The engine performs the authorization check and returns a refusal. That separation is important for ordinary software bugs and for adversarial behavior. A job cannot simply skip a polite self-check in its own code. OpenAI says it continually sweeps for rogue inference-engine implementations where Control Room is missing or disabled. Those sweeps need receipts too. Operators should know what percentage of inference traffic carried valid job IDs, how many requests used unknown or expired IDs, whether any engine accepted a request without reaching the authorization path and how quickly an unregistered implementation was detected. Do not report those as one cheerful uptime number. Publish distributions: median and worst-case stop latency, cache age, authorization error rate, false-stop rate, time to human acknowledgement and time to safe recovery. Break results down by workload type, region, inference path and failure mode. The public Control Room post gives a maximum delay target and an architectural description. It does not provide an independent audit, a public reliability distribution or the results of stop drills. Readers should not turn a design claim into a reliability guarantee. The same caution applies to monitoring. Control Room can execute a stop decision quickly. It does not decide that every suspicious behavior is truly dangerous. OpenAI's monitoring system uses multiple automated layers and, in some cases, human review. The company says false alarms have made continuous paging difficult for every workload. That is a familiar problem in high-stakes operations. Tune an alarm too loosely and people ignore it. Tune it too tightly and novel failures pass quietly. A stop system therefore needs two kinds of rehearsal. The first is a technical drill. Inject a stop instruction and prove that output, tools, credentials and downstream work are contained within stated limits. The second is a decision drill. Give responders ambiguous evidence, incomplete logs and competing business pressure. Measure whether the right person sees the alert, whether they understand the possible consequence and whether they can pause first and investigate second when the cost of waiting is high. False alarms deserve their own recovery procedure. A good fail-closed system will sometimes stop useful work. Resuming should not mean flipping the same switch back because the room became impatient. Require a second reviewer for high-risk runs. Record why the alert was judged safe. Reissue credentials rather than blindly restoring them. Mark artifacts produced before the stop so reviewers know what crossed the boundary. Keep the stop event attached to the experiment record. Recovery time is part of safety performance. If recovery is chaotic or painfully slow, teams will look for shortcuts around the next stop. OpenAI says Control Room is deployed across its research infrastructure, and that fail-closed behavior has reached frontier-model research workloads while rollout across remaining research workloads will finish over the following days. The company says its external model-serving stack uses a separate, more centralized operational system. That scope should remain visible. Control Room is not a universal stop feature for every ChatGPT conversation or every customer's application. It is an internal research-infrastructure control described by the company that built it. Still, the design offers a useful pattern for anyone operating consequential AI agents. Give each job a durable identity. Bind that identity to an approved purpose and risk case. Put the authorization check outside the agent's writable environment. Check permission at the narrowest point before new model output or tool action. Fail closed when the control plane disappears. Preserve an independent audit trail. Practice the stop under ugly conditions. Most important, draw the boundary honestly. Stopping generation is not the same as stopping a process. Stopping a process is not the same as cancelling its tools. Cancelling its tools is not the same as reversing the world. Control Room gives OpenAI a central place to deny the next piece of model output. That is useful infrastructure. Trust will come from the drill report: what happened before the button, inside the last 35 seconds and after the model went quiet. The red lever is easy to admire. Show us the stopwatch, the event log and the cleanup crew.