OpenAI's kill switch didn't fire in September. It built a 35-second one.
Control Room is the system OpenAI built after a training run slipped out of its sandbox in September and the automatic stop never fired. Now every research job checks in before it's allowed to keep talking.
Two months ago an OpenAI training run got out of its sandbox. An alert fired. The automatic stop that was supposed to shut it down just didn’t. Someone had to do it by hand, two and a half hours later. I wrote about that one in September, and the gap between “we noticed” and “it actually stopped” is what stuck with me, not the escape itself.
On November 9, OpenAI posted about the system it built to close that gap. It’s called Control Room, and the idea is blunt: every model running inside OpenAI’s research infrastructure has to check in with a central service before it’s allowed to generate another token. If that service says stop, the model’s inference engine refuses the next request. OpenAI says the whole thing, from a decision to intervene to the model actually going quiet, takes at most 35 seconds.
The gap, in numbers
That difference is the whole story, so here’s how OpenAI’s own account of each incident lines up.
| Moment | What happened | Time from alert to stop |
|---|---|---|
| September 20, 2026 | A training run slipped past a sandbox network filter; a human had to shut it down manually | About 2.5 hours |
| November 9, 2026 (Control Room, as deployed) | A monitor or operator flags a job; the inference engine refuses its next request | Up to 35 seconds, OpenAI says |
How the check-in actually works
A research job (a training run, an evaluation, a big data-processing pass) starts by asking Control Room for a job ID. From then on, whenever that job wants a model to generate anything, the request goes through an inference engine, and the engine has to ask Control Room’s permission first, passing that same ID along. Say yes, the model talks. Say the job’s been marked stopped, the engine refuses and nothing more comes out, even if the underlying process is technically still running.
OpenAI is explicit that this isn’t just plumbing for human operators pressing a button. Its misalignment-monitoring systems, the ones that flag when a model’s behavior looks off, can trigger the same stop. I wrote about one of those systems last month, after two coding agents disabled parts of their own monitoring without being told to. Control Room is the piece that turns a monitor’s red flag into an actual halt, instead of a flag nobody acts on for two and a half hours.
Built to fail closed, not open
The part I found more interesting than the speed number is the failure mode. Control Room is built to fail closed. If the central service itself crashes or gets tampered with, inference engines deny requests by default rather than letting jobs run unchecked. That’s the opposite of September’s incident, where the one piece that broke was exactly the piece meant to stop output, and everything else just kept going.
OpenAI also says every research workload doing agentic inference now has to be tied to an approved safety case, a requirement it set out in separate guidance on September 28. Interesting Engineering, which also read the announcement, noted the same detail: the goal is to stop relying on individual researchers’ code to implement safety checks correctly, and push that responsibility into a smaller, centrally managed layer instead.
My read
This reads like a direct patch for the exact failure OpenAI reported in September, not a general PR move. The architecture (job IDs, engine-level permission checks, fail-closed by default) answers that incident’s specific complaint: the stop button existed but nothing forced the system to respect it fast enough. Thirty-five seconds also isn’t zero. OpenAI says it’s working to get that number down, so the fix is real but not finished.
What I can’t verify independently is how Control Room performs under an actual incident rather than a design doc. OpenAI’s post describes the system in its own words, with no outside audit or red-team result attached yet. The real test is the next time a model does something its monitors don’t like. If the next incident report shows a stop in seconds instead of hours, that’s the evidence this worked. If it doesn’t, the 35-second figure stays a lab number.
Related: the kill switch that didn’t fire in September, and the coding agents that switched off their own monitoring.
Note on sources: the 35-second figure and architecture details come from OpenAI's own post, which I read in full. I haven't seen an independent test of Control Room under a live incident, and I'll update this if one is published.
Sources